@sema-agent/core 7.23.1 → 7.23.3

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 7.23.3 — 2026-09-19
+
+### Read boundary — an operand the shell EXPANDS is judged by the deployment's deny judge, at the one moment the expansion exists (#934; P1; execute-time recheck; @cli @server @client-core)
+- **Before.** Under `shellGate:"classify"` + `readFace:"roots"` with a deny table wired, `cat .en?` cost ZERO cards and returned `.env`'s bytes; so did `cat secrets*/app.txt` and `grep . secret?/app.txt`, in the headless and the wired-approver deployment alike. Three passes each declined, and each was right to: the classify walk judges an unexpanded glob on its UNEXPANDED spelling (`<root>/.en?` is on no deny table) and parks it as `undecidedPaths`; the read-only command tables then cleared that ordinary card (`cat` is a listed reader; the table knows nothing about paths); and the execute-time canonical recheck (#775) — the one pass that HOLDS a filesystem and does expand the pattern — asked only "does this land outside the roots?". **A deny-listed expansion is in-root by definition**, so the containment question can never be the one that catches it. Not a 7.23.1 regression: the same reading since 7.22.x.
+- **After — one rule: an EXPANSION IS AN OPERAND.** The recheck leg hands every path it establishes to `BashReadonlyRootBoundary.denyMatch` — the SAME function object the approval-time walk holds, forwarded, never a second matcher — and asks it BEFORE containment, the order the walk itself applies (deny outranks; no root grant clears a deny row). Rules: ±0 judges, −1 drop. The expander's property-6 shortcut used to DELETE an in-root non-symlink match outright; what that shortcut buys is the `realpath` call, so the match is now handed over WITH the canonical location the enumeration already established, and the judge answers both questions on it at the same cost. The deny question is asked of the FOLDED view, because that is the form the walk decides on — `cat secrets/../sub/a.txt` reads `sub/a.txt` and is not refused.
+- **Two views per path, and which is NEW is the whole of the change.** The operand's own spelling — already judged for a literal candidate, NEVER judged for an expansion the shell produces after the verdict — and the canonical TARGET, which no lexical pass can reach on either list. The second closes the deny seat's stated residual ② (an in-root symlink whose target is guarded: `cat notes.txt` → `<root>/.env` also disclosed at zero asks), which that seat's own contract already named this leg as the closer of. Judging the spelling of expansions ALONE would have been a second rule.
+- **The same leak had a second site, and the face was the reason.** With `readFace:"open"` the leg exited before doing anything — a CONTAINMENT-shaped exit applied to the whole pass — so `cat .en?` and `cat notes.txt` disclosed the file at zero asks there too, on a face whose deny seat's own contract reads "the deny half above keeps judging in both faces" (the LITERAL `cat .env` was mandated there all along, which is what proves the floor is real). Which half still has a question is now one value the face decides member by member: containment OFF under open (an out-of-roots operand rides `checkedPaths` there as an ACCEPTED candidate; re-judging it would make the open face stricter than the closed one), deny ON in both. With neither question the leg does not run, so an open face with no deny table is answered exactly as before. Rules: −1 face special case. Both directions pinned — the deny cells AND the containment controls (an out-of-root read, plain and globbed, still runs under open with a deny table wired).
+- **A third site, found by the adversarial round and confirmed by construction.** The expander had one more containment shortcut: when a glob's LAST directory canonicalized OUTSIDE the roots, it pushed that DIRECTORY and discarded the matches. Containment reached the right verdict through the directory, which is why the shortcut survived — and the deny half never can, because a deny row is about the FILE. Measured on the parent: under the open face, `cat vendor/.en?` (an in-root directory symlink pointing out) and `cat <outside>/.en?` both disclosed the file at zero asks. The expander now hands over the matches themselves with whatever canonical facts it already holds; containment may use those as shortcuts, it may not replace the operands. Consequence, disclosed: the closed face's `readonly_out_of_root` refusal for such a glob now names the FILES (`<outside>/secret`, `<outside>/second`) instead of the directory — strictly more precise, and `test/backlog775-glob-canonical-recheck.test.ts` A1-a is re-pinned to it. A consumer counting `details.paths` entries for this refusal sees one row per escaping match rather than one per escaping directory.
+- **Precedence, made one rule.** An expansion the leg cannot establish used to RETURN immediately, which ranked it above a deny row a later operand would have produced — the one order this leg is not free to choose. It is now recorded like every other objection and the three are ranked once, at the end: deny > unestablished > containment. Every such command was refused before and is refused now; only which sentence it carries can change.
+- **Not the other repair.** Widening the classify seat's weak rung to `boundaryUnread` would turn every in-root glob into an ordinary card — a narrowing for every deployment, deny table or not. RB-474b's ordinary card, the classify seat's card shape and the off/bypass seats are untouched.
+- **Reach.** Only a deployment with a deny judge wired (`readDenyPatterns`, or a selected built-in tier — default OFF) sees anything: without one the boundary carries no `denyMatch` and this leg's answer is byte-identical, on both read faces. `bash_readonly` is unaffected — that face wires no deny judge at all (v1 ruling). No second adjudication: a deny row the walk RAISED returns a verdict carrying no candidates, so an approver's yes still runs the command. An execute-time deny refusal is NOT clearable by a stored allow rule or by the auto classifier — it is past the approval step, which is what makes it stronger than the accepted reach #891 states for a retired ordinary card.
+- **Stated reach on the open face.** The leg's fail-closed arm travels with the deny half: under `readFace:"open"` WITH a deny table, a candidate this leg cannot ESTABLISH — a glob nobody can expand (an uncompilable range, an unenumerable directory, an expansion past the enumeration caps), or a literal whose chain the resolver could neither answer nor rule absent — is now refused rather than run, because a location that cannot be established cannot be deny-judged either. The closed face always answered that way; an open face with no deny table does not run the leg at all and is unchanged. Measured in both directions.
+- **Still open, stated rather than assumed gone.** A DECLARED isolated sandbox keeps the lexical-only leg (property 3): its `canonicalPath` is an RPC into a namespace this process cannot resolve, so no expansion can be established there and the deny half stays at the approval walk's unexpanded-spelling reading. The sandbox is that deployment's declared floor. A RECURSIVE verb's directory operand (`grep -r . <dir>`) is judged on the operand, never on its subtree — measured at one mandated ask with no disclosure, so it is asked rather than leaked, but what a yes then opens is the execution environment's floor.
+- **headless.** Restrictive direction: a deny-listed read that reached a headless run through a glob, or through an in-root symlink, is now refused instead of executed. The refusal is the fs boundary's own card (`read_path_denied`, with `target` and the matched `pattern`), the same one `Read`/`Grep`/`Glob` mint — one rule, learned once.
+- Pins: `test/backlog934-glob-expansion-deny-judge.test.ts` (3 shapes × 2 approver arms, judge-identity via a case-folded pattern, the symlink view, the wire card, and five controls: RB-474b unchanged, no deny table, #775 unflipped, two `..`-over-fire shapes, and the approved deny row).
+
+## 7.23.2 — 2026-09-19
+
+### Rendering a thrown value is one total rule — a hook could kill the engine with its choice of rejection value (#926; P1, failure face; @cli @server @client-core: text only, no wire key)
+- **Before.** `err instanceof Error ? err.message : String(err)` and its normalizing twin `err instanceof Error ? err : new Error(String(err))` appeared 270 times across 100 files. Both are PARTIAL on the non-Error arm: `String` calls the value's own `toString` / `Symbol.toPrimitive`, so a null-prototype object throws `TypeError: Cannot convert object to primitive value` and a value whose own hook throws propagates that instead. The thrower is deployment code — a `Hooks` callback, a plugin, an adapter rejection — so the rendering step was the one step that could destroy the report it exists to produce.
+- **On the hook seat it was fatal, twice, on two different failure modes.** A hook that REJECTS reached the seat's reject arm, where the render sat inside a promise rejection handler whose derived promise nobody awaited: the `TypeError` became an unhandled rejection and Node terminated the process. A hook that throws SYNCHRONOUSLY escaped the seat before it wrapped anything and reached the crash-text site instead, which carried the same coercion. Measured on the parent tree, each mode exits 1 from its own line. A `preToolUse` hook returning `Promise.reject(Object.create(null))` was enough to end the run — and the engine with it.
+- **After.** One rule, in one leaf module. `thrownText` is total: a thrown STRING is its own message, an `Error` hands over `message` VERBATIM, and anything else is described structurally by the describer the engine already shares for rejected values. `asThrownError` is the same rule for callers that need an `Error` object, and passes an `Error` through by IDENTITY. Every read inside both is guarded, because the reads are themselves attacker-reachable (`instanceof` walks a prototype chain a revoked proxy can trap; `message` can be an accessor that throws). `describeThrown` stops carrying its own duplicate label and becomes what it always claimed to be — the containment face of that one rule. Rules: −1 describer, and 285 copies of one idiom become one call.
+- **Byte identity, which is the promise that matters for a sweep this wide.** The two arms that carry nearly all production traffic are unchanged: an `Error` yields exactly `err.message` (no cap, no one-lining, no quoting, empty stays empty so `… || "unknown"` folds as before), a thrown string yields exactly itself, and every primitive keeps the spelling `String` gave it. Pinned as literals, in both failure modes.
+- **Reach.** What moves is only the text for values that used to render uselessly or fatally: `[object Object]` becomes `an object with keys [a, b]`, `1,2` becomes `an array of 2 member(s)`, a thrown FUNCTION stops printing its entire source (unbounded, and forgeable through `toString`) and becomes `a function`, `1n` is no longer spelled `1`, and the three shapes that used to throw now describe. No gate decision, no control flow and no wire key changes anywhere; a hook crash still fails CLOSED and still reports through the same seats. Deployments that match on the text of a non-Error failure — a log scraper, a test that pinned `[object Object]` — are the only readers affected, and headless is unchanged: the same refusal, with a sentence a reader can act on.
+- **Cross-realm Errors, and the face that names the class.** `instanceof Error` compares against THIS realm's prototype, so a genuine `Error` thrown by a workflow script running inside `vm.createContext` used to be described as an anonymous object with its message gone; the rule brands by `[object Error]` instead, which is realm-independent. And a bare `String(err)` never said the message — it said `TypeError: boom`, the CLASS and the message. Sites that spelled the bare form keep that text through a second face of the same rule, because at least one of them is load-bearing: the teacher's stuck detector keys its signature on it, and collapsing two error classes with equal messages into one string would have let an alternating student accumulate a streak and be abandoned mid-run.
+- **Local normalizers that hand-rolled totality are now total.** Measured before the change: a revoked-proxy stdin error, and one whose `message` is a throwing getter, both ESCAPE the LSP transport's event handler — so the transport never closes. Those duck-typed `.message` reads sat outside any guard. Same shape in the worktree reason helper and the harness normalizer. All three read inside the guard now, with the shared rule as the fallback.
+- **Two sites were reverted after the full suite, and say so in the gate rather than going quiet.** A rejected closed-set WORD is not a thrown value, and the structural describer quotes strings — a word already inside quotes came out doubled; and the notifier door's coercion already sat inside its own guard, where a constant stand-in is the stated contract rather than an accident. Both keep their own partial coercion and are ticketed. A third, the erasure announcement, deliberately RELAYS the value's own text scarred by the neutralizer — a structural description would delete the evidence the announcement exists to carry — so its coercion is kept and merely made total.
+- **Known and unchanged.** The deployment error lane still receives the RAW value for a synchronous hook throw and a normalized `Error` for a rejection; the lane is typed `unknown` and that asymmetry predates this change, so it is pinned rather than quietly fixed. `asThrownError` deliberately does NOT attach the original value as `cause`: cause chains are walked elsewhere to attribute error codes, and letting an arbitrary thrown object start supplying codes belongs with those readers, not with a rendering fix. Two functions named `toError` (engine/lsp, engine/harness) still exist with different behaviour; both are total now, and the harness one still asks the value to narrate itself through `JSON.stringify` — the older self-narration class, untouched here.
+
+# Changelog
+
+### Read boundary — a read the boundary DECLINED to judge is no longer cleared by the engine's read-only tables (#930 / sema-internal #65; classify seat; @cli @server @test)
+- **Before.** Under `shellGate:"classify"` + `readFace:"roots"`, a command whose operand list arrives through a STREAM (`echo <path> | xargs grep .`) is one the read walk cannot judge: it says so with a decline, and 7.23.1's classify seat reads no decline as mandate evidence (ruling C-R67 (B), #891) — deliberately, so that a person, the auto-mode classifier or a person's stored allow rule may answer the resulting card. The seat's stated premise for that trade was that the shape classifier "refuses all these shapes anyway", which was true of the PROBE and false of the OUTCOME: the gate's allow layer has a second member that is not the shape classifier — the read-only command tables (#619) — which recognises `xargs <a listed target>` from a table of program names, knows nothing about paths, and retired the card at ZERO asks. Fourteen shapes measured on a real shell, in BOTH the headless and the wired-approver deployment, with the file's contents coming back in the tool output: `echo <path> | xargs grep|head|tail|wc -l|grep -l`, `find … | xargs wc -l`, `printf '%s\0' … | xargs -0 wc -l`. **No deny table is needed** — roots alone are the boundary, which is what a `permissionMode` of "default" or "acceptEdits" mounts; the deny-listed spellings are the second half. The SANDBOX-ADMISSION arm cleared the same card on the same reasoning, measured at the unit face. `default`/`off`/`bypass` were never affected (their seat reads both declines as evidence, so the ask was mandated there), and `| xargs cat` was never affected (`cat` is not in the read-only tables' xargs target list).
+- **After.** The boundary's answer over a command is a LADDER with three rungs, one question: DECLARED an objection (`mandated` — no lane, no rule) > DECLINED to judge (`ReversibilityVerdict.boundaryDeclined` → the gate's `GatePass.probeBoundaryDeclined`) > silent. The middle rung leaves the card ORDINARY for every ANSWERER — a person, the classifier and a stored allow rule all still clear it, which is exactly what C-R67 (B) bought — and withholds **both** allow-layer members that answer nothing: the read-only command tables (which recognise a command SHAPE) and sandbox admission (whose own comment already says containment holds EFFECTS and does not speak to what reaches the model). Rules: ±0 predicates (`readBoundaryMandate` is still the single seat-shared answer and gains a return rung; `refusedCommandMayRead` now reports the decline it already computed instead of returning a bare "exempt" that reads as "the boundary judged and objects to nothing"). No new mandate word: `PERSISTED_RULE_MANDATES` is unchanged, so the persisted-rule lane and the classifier read this ask exactly as they did.
+- **Difference from 7.23.0.** 7.23.0 refused these shapes with a MANDATE (no classifier, no stored rule, confirm-or-refuse). This version is strictly looser than that and strictly tighter than 7.23.1: an ordinary card an answerer may settle.
+- **Reach.** Any deployment that wires a read boundary (`readFace` + roots, with or without `readDenyPatterns`) under `shellGate:"classify"`: a shell command whose operands the walk could not read — a stream-fed operand list, an unreadable program position — now reaches the person/classifier instead of being auto-allowed by the read-only tables. In-root spellings of the same shapes (`echo sub/x.txt | xargs grep .`) are in that set too: the boundary declined for them as well, and "in root" is a fact nobody established. Commands with no decline are untouched — `git status`, `ls -la` and every other read-only shape the tables clear keep costing zero questions.
+- **headless.** Restrictive direction, and the reason this is a P1: a headless classify-tier run that executed these stream-fed reads with no approver now refuses them (an ask with no approver is a refusal). A deployment relying on that auto-allow should widen its roots, store an allow rule for the command, or wire an approver/classifier.
+- **The other half, measured here and FIXED in this same version by #934 below.** "The boundary could not read where this command reads" has a second family — an UNEXPANDED GLOB (`undecidedPaths`), a plain card by ruling (RB-474b) and still cleared by the read-only tables. Its containment half was already caught at execute time by the canonical recheck (#775); its DENY half was not, because that recheck judged roots only, so `cat .en?` under `readDenyPatterns:["**/.env"]` disclosed `.env` at zero asks on 7.23.1 and on this tree alike. This version does not change the CARD (RB-474b stands); it gives the execute-time recheck the boundary's own deny judge — see the #934 section.
+- Pins: `test/backlog930-decline-not-read-only-clearable.test.ts` (14 shapes × 2 arms, + the C-R67 (B) surface, the sandbox arm with its own three-way control, the off seat's mandate, the read-only arm still alive, and the `xargs cat` / in-root controls).
+
 ## 7.23.1 — 2026-09-18
 
 ### Read boundary — a `$` inside SINGLE QUOTES no longer refuses the whole command (#921, ruling C-R67 ③; behaviour face, both seats; @cli @server @client-core re-pin)

package/dist/agents/agent-transcript-tool.js

@@ -7,6 +7,7 @@ import { stepsFromMessages } from "./subagent-steps.js";
 import { REPORT_FIELD_MAX } from "./subagent.js";
 import { getSessionRetainLedger } from "./retain-ledger.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
+import { thrownText } from "../core/thrown-value.js";
 export const AGENT_TRANSCRIPT_TOOL_NAME = "AgentTranscript";
 const AGENT_TRANSCRIPT_DEFAULT_N = 20;
 const AGENT_TRANSCRIPT_MAX_N = 50;
@@ -110,7 +111,7 @@ export function createAgentTranscriptTool(opts) {
             catch (e) {
                 const code = e?.code;
                 return {
-                    content: `No transcript: agent ${id}'s session could not be read (${code ?? (e instanceof Error ? e.message : String(e))}).`,
+                    content: `No transcript: agent ${id}'s session could not be read (${code ?? (thrownText(e))}).`,
                     details: { error: code ?? "read_failed", id },
                     isError: true,
                 };

package/dist/agents/cascade.js

@@ -3,6 +3,7 @@ import { releaseSession } from "./session-util.js";
 import { mapNestedSuspend, isDurablePause } from "./suspend-guard.js";
 import { buildCumulativeStats } from "./cumulative-stats.js";
 import { createSafeNotifier } from "../core/safe-notify.js";
+import { thrownText } from "../core/thrown-value.js";
 const CASCADE_ON_RUNG_SITE = "cascade.onRung";
 const CASCADE_CONFIG_ERROR_CODE = "config.cascade_invalid";
 const CASCADE_NO_DISPATCH_ERROR_CODE = "cascade.budget_exhausted";
@@ -172,7 +173,7 @@ export async function runCascade(runner, spec, config, internals) {
             }
             catch (e) {
                 passed = false;
-                gateError = e instanceof Error ? e.message : String(e);
+                gateError = thrownText(e);
             }
             const statusRejected = passed && config.acceptPartial !== true && result.terminal.kind !== "completed";
             if (statusRejected)

package/dist/agents/list-agents-tool.js

@@ -5,6 +5,7 @@ import { formatPeerNameRef } from "./cross-session-ref.js";
 import { entryAccessible } from "./roster-store.js";
 import { mintPeerSessionCandidates, peerSessionBoxHandle } from "./peer-directory.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
+import { thrownText } from "../core/thrown-value.js";
 export const LIST_AGENTS_TOOL_NAME = "ListAgents";
 export const LIST_AGENTS_TOOL_ALIAS = "ListPeers";
 export const LIST_AGENTS_MAX_RESULT_CHARS = 10_000;
@@ -27,7 +28,7 @@ export function createListAgentsTool(opts) {
                 peerRows = await opts.peerDirectory.listPeerSessions({ scope: opts.self.scope });
             }
             catch (e) {
-                directoryFault = e instanceof Error ? e.message : String(e);
+                directoryFault = thrownText(e);
             }
             for (const c of mintPeerSessionCandidates(peerRows, { sessionId: opts.self.sessionId })) {
                 const r = c.record;

package/dist/agents/observer.js

@@ -3,6 +3,7 @@ import { defineTool } from "../core/tools.js";
 import { createSafeNotifier } from "../core/safe-notify.js";
 import { escapeEnvelopeTag } from "../core/untrusted-text.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
+import { thrownText } from "../core/thrown-value.js";
 export const OBSERVER_EVENT_TAGS = ["tool-call", "user-message", "tool-result", "turn-ended"];
 const TAG_ESCAPE_RE = new RegExp(`<(?=/?(?:${OBSERVER_EVENT_TAGS.join("|")})(?:[>\\s/]|$))`, "gi");
 export function escapeObserverTags(text) {
@@ -309,7 +310,7 @@ export class ObserverPairing {
                     if (this.buffer.length > 0) {
                         const strandedCount = this.buffer.length;
                         this.buffer = [];
-                        this.safeOnError(new Error(`observer delivery: ${strandedCount} segment(s) enqueued mid-fault were stranded and dropped (never attempted) after: ${err instanceof Error ? err.message : String(err)}`));
+                        this.safeOnError(new Error(`observer delivery: ${strandedCount} segment(s) enqueued mid-fault were stranded and dropped (never attempted) after: ${thrownText(err)}`));
                     }
                     return;
                 }
@@ -341,7 +342,7 @@ export class ObserverPairing {
             catch (restartErr) {
                 this.firstRunDone = false;
                 throw restartErr instanceof Error
-                    ? new Error(`${restartErr.message} (after resume-state loss: ${err instanceof Error ? err.message : String(err)})`, { cause: restartErr })
+                    ? new Error(`${restartErr.message} (after resume-state loss: ${thrownText(err)})`, { cause: restartErr })
                     : restartErr;
             }
         }

package/dist/agents/peer-session-drain.js

@@ -11,6 +11,7 @@ import { peerHeldQueueFor } from "./peer-held-queue.js";
 import { peerIdleMachineFor } from "./peer-idle.js";
 import { describePeerIdleSubscription, isPeerDeliveryReceiptState, isPeerIdleNoticeKind, peerIdleNoticeLabel, renderCrossSessionDeliveryNotice, renderCrossSessionDroppedNotice, renderCrossSessionIdleNotice, resolveCrossSessionDialogExpiry } from "./peer-notices.js";
 import { routePeerDeliveryReceipt, routePeerDroppedReceipt, routePeerIdleNotice } from "./peer-notice-route.js";
+import { thrownText } from "../core/thrown-value.js";
 export const PEER_DRAIN_LEASE_TTL_MS = 5 * 60_000;
 export const PEER_SESSION_ID_UNGRAMMATICAL_CODE = "peer.session_id_ungrammatical";
 export function judgePeerLaneMount(deps, sessionId) {
@@ -304,7 +305,7 @@ export function createPeerSessionDrain(opts) {
                 payload = buildPeerMessagePayload(m);
             }
             catch (e) {
-                disclose("refused", `record fields cannot be rendered canonically (${e instanceof CrossSessionCodecError ? e.code : e instanceof Error ? e.message : String(e)})`, m);
+                disclose("refused", `record fields cannot be rendered canonically (${e instanceof CrossSessionCodecError ? e.code : thrownText(e)})`, m);
                 settledUpTo = m.seq;
                 continue;
             }

package/dist/agents/retain-ledger.js

@@ -2,6 +2,7 @@ import { delimitUntrusted } from "../core/untrusted-text.js";
 import { PEER_MESSAGE_NOTICE } from "./peer-admission.js";
 import { createSafeNotifier } from "../core/safe-notify.js";
 import { RETAIN_DEFAULT_TTL_MS, RETAIN_DEFAULT_MAX } from "../config/defaults.js";
+import { asThrownError } from "../core/thrown-value.js";
 export const SUBAGENT_RESUME_CAP = 8;
 export class SubagentRetainLedger {
     ttlMs;
@@ -30,7 +31,7 @@ export class SubagentRetainLedger {
         return this.notifier.failuresAt("retainLedger.onEvictionError");
     }
     noteDetachedFailure(trigger, error, parentToolCallId) {
-        const err = error instanceof Error ? error : new Error(String(error));
+        const err = asThrownError(error);
         this.failedEvictions += 1;
         this.lastFailure = err;
         this.notifier.notify(() => this.hooks?.onEvictionError?.({ ...(parentToolCallId !== undefined ? { parentToolCallId } : {}), trigger, error: err }), "retainLedger.onEvictionError");

package/dist/agents/send-message-tool.js

@@ -15,6 +15,7 @@ import { SUBAGENT_RESUME_CAP, SubagentRetainLedger, getSessionRetainLedger } fro
 import { createSubagentResume } from "./subagent.js";
 import { appendHopToken, judgePeerAdmission, peerAxisToken, resolvePeerAdmissionConfig, PEER_MESSAGE_NOTICE, } from "./peer-admission.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
+import { thrownText } from "../core/thrown-value.js";
 export const SEND_MESSAGE_TOOL_NAME = "SendMessage";
 let uplinkSeqGlobal = Date.now();
 const UPLINK_RESULT_MAX = 8000;
@@ -245,7 +246,7 @@ export function createSendMessageTool(opts) {
                     return resolvePeerSessions(rows, to, peerSelfSessionId !== undefined ? { sessionId: peerSelfSessionId } : undefined);
                 }
                 catch (e) {
-                    return { status: "directory_fault", message: e instanceof Error ? e.message : String(e) };
+                    return { status: "directory_fault", message: thrownText(e) };
                 }
             };
             const deliverToPeerSession = async (c) => {
@@ -288,7 +289,7 @@ export function createSendMessageTool(opts) {
                         if (e?.code === MAILBOX_TOMBSTONED_RECIPIENT_CODE) {
                             return peerRefusal("peer_send.invalid_target", `${peerLabel} is being deleted — its box no longer accepts messages. Nothing was parked; do not retry.`);
                         }
-                        return peerRefusal("peer_send.other", `the session box refused the message (${e instanceof Error ? e.message : String(e)}) — nothing was parked. ${DEDUP_RETRY_NOTE}`);
+                        return peerRefusal("peer_send.other", `the session box refused the message (${thrownText(e)}) — nothing was parked. ${DEDUP_RETRY_NOTE}`);
                     }
                 }
                 let subscription;
@@ -314,7 +315,7 @@ export function createSendMessageTool(opts) {
                             }
                             catch (e) {
                                 peerIdleMachineFor(peerScope, peerSelfSessionId).requester.settle(record.sessionId, "unavailable");
-                                subscription = { ok: false, code: e?.code === MAILBOX_TOMBSTONED_RECIPIENT_CODE ? "peer_send.invalid_target" : "peer_send.other", severity: "error", message: `the session box refused the subscription record (${(e instanceof Error ? e.message : String(e)).slice(0, 200)}) — no subscription was made.` };
+                                subscription = { ok: false, code: e?.code === MAILBOX_TOMBSTONED_RECIPIENT_CODE ? "peer_send.invalid_target" : "peer_send.other", severity: "error", message: `the session box refused the subscription record (${(thrownText(e)).slice(0, 200)}) — no subscription was made.` };
                             }
                         }
                     }
@@ -427,7 +428,7 @@ export function createSendMessageTool(opts) {
                         }, { priority: "next" });
                     }
                     catch (e) {
-                        return { content: `Message not sent: the parent's notification lane rejected it (${e instanceof Error ? e.message : String(e)}). ${DEDUP_RETRY_NOTE}`, details: { error: "uplink_failed", to }, isError: true };
+                        return { content: `Message not sent: the parent's notification lane rejected it (${thrownText(e)}). ${DEDUP_RETRY_NOTE}`, details: { error: "uplink_failed", to }, isError: true };
                     }
                     return {
                         content: `Message sent to main — queued for the spawning conversation at its next turn boundary. If that conversation finishes before reading it, the message may not survive. Continue with your task; do not wait for a reply.`,
@@ -568,7 +569,7 @@ export function createSendMessageTool(opts) {
                                 announceTranscriptIntegrityGapOnce(handle, scope, opts.onTranscriptIntegrityGap);
                                 return queueFullReceipt(`No transcript found for agent ${handle}, so a revival cannot drain the backlog.`);
                             }
-                            return queueFullReceipt(`Its transcript store did not answer (${e instanceof Error ? e.message : String(e)}) — this send did not start a backlog drain; a later resend will try again.`);
+                            return queueFullReceipt(`Its transcript store did not answer (${thrownText(e)}) — this send did not start a backlog drain; a later resend will try again.`);
                         }
                         const drainLeaseOwner = `${opts.registry.writerId}:${ctx.toolCallId}`;
                         let drainLease = null;
@@ -589,7 +590,7 @@ export function createSendMessageTool(opts) {
                             drainSpawned = await opts.reviveSpawn({ row: claimed, rev: claimedRev, prompt: drainPrompt, peerSeed: { hopChain: [...drainSeed] } });
                         }
                         catch (e) {
-                            drainSpawned = { isError: true, content: e instanceof Error ? e.message : String(e) };
+                            drainSpawned = { isError: true, content: thrownText(e) };
                         }
                         if (drainSpawned.isError === true) {
                             try {
@@ -672,7 +673,7 @@ export function createSendMessageTool(opts) {
                             };
                         }
                         return {
-                            content: `Message not sent: ${whoT3}'s transcript store did not answer (${e instanceof Error ? e.message : String(e)}) — nothing was parked; send again. ${DEDUP_RETRY_NOTE}`,
+                            content: `Message not sent: ${whoT3}'s transcript store did not answer (${thrownText(e)}) — nothing was parked; send again. ${DEDUP_RETRY_NOTE}`,
                             details: { error: "session_store_unavailable", to },
                             isError: true,
                         };
@@ -691,7 +692,7 @@ export function createSendMessageTool(opts) {
                             };
                         }
                         return {
-                            content: `Message not sent: the durable mailbox refused the message (${e instanceof Error ? e.message : String(e)}) — nothing was parked and the agent was not revived. ${DEDUP_RETRY_NOTE}`,
+                            content: `Message not sent: the durable mailbox refused the message (${thrownText(e)}) — nothing was parked and the agent was not revived. ${DEDUP_RETRY_NOTE}`,
                             details: { error: "mailbox_failed", to },
                             isError: true,
                         };
@@ -720,7 +721,7 @@ export function createSendMessageTool(opts) {
                         spawned = await opts.reviveSpawn({ row: claimed, rev: claimedRev, prompt: revivePrompt, peerSeed: { hopChain: [...reviveSeed] } });
                     }
                     catch (e) {
-                        spawned = { isError: true, content: e instanceof Error ? e.message : String(e), details: { error: "revive_failed" } };
+                        spawned = { isError: true, content: thrownText(e), details: { error: "revive_failed" } };
                     }
                     if (spawned.isError === true) {
                         try {
@@ -1040,7 +1041,7 @@ export function createSendMessageTool(opts) {
                                                 `${who}'s registry row is being adjudicated right now (a revival claim or a reap sweep holds it) — send again in a moment. ${DEDUP_RETRY_NOTE}`
                                             : code === "resume.row_gone"
                                                 ? `${who}'s registry row no longer exists (terminal GC) — relaunch a new agent instead.`
-                                                : `${e instanceof Error ? e.message : String(e)} ${DEDUP_RETRY_NOTE}`;
+                                                : `${thrownText(e)} ${DEDUP_RETRY_NOTE}`;
                     return { content: `Message not sent: ${text}`, details: { error: code ?? "resume_failed", to }, isError: true };
                 }
             });

package/dist/agents/subagent.js

@@ -67,6 +67,7 @@ import { LAUNCH_RECEIPT_OWN_WORDS_CLAUSE, launchReceiptNoQuoteClause } from "./l
 import { ObserverDigestTap, ObserverPairing, createObserverReportToolSpec, markObserverTaskId, unmarkObserverTaskId, isObserverTaskId, ObserverResumeStateError, ObserverStoppedByUserError, observerFramingPrompt, observerSlug, resolveObserverDeclaration, } from "./observer.js";
 import { SubagentStepRecorder } from "./subagent-steps.js";
 import { toolFace } from "../core/tool-catalog-entries.js";
+import { thrownText } from "../core/thrown-value.js";
 const BG_AGENT_RESULT_MAX = 4_000;
 const BG_AGENT_RESULT_FULL_MAX = 200_000;
 function resultSettleFields(result) {
@@ -291,7 +292,7 @@ export function createSubagentWorktreeHelper(baseEnv, repoRoot) {
         async mint(childId) {
             const probe = await baseEnv.exec("git rev-parse --is-inside-work-tree", { cwd: repoRoot });
             if (!probe.ok || probe.value.exitCode !== 0) {
-                const detail = probe.ok ? (probe.value.stderr || probe.value.stdout).trim().split("\n")[0] : String(probe.error);
+                const detail = probe.ok ? (probe.value.stderr || probe.value.stdout).trim().split("\n")[0] : thrownText(probe.error);
                 throw new Error(`the working directory ${repoRoot} is not a git repository${detail ? ` (${detail})` : ""}`);
             }
             const { env, worktreeDir } = await addWorktree(baseEnv, {
@@ -817,7 +818,7 @@ export function createSubagentResume(deps) {
                 }
             }
             catch (e) {
-                const msgRevive = e instanceof Error ? e.message : String(e);
+                const msgRevive = thrownText(e);
                 const errCodeReviveReject = abort.signal.aborted ? undefined : thrownErrorCode(e);
                 const errClassReviveReject = abort.signal.aborted ? undefined : classifySubagentError({ kind: "failed", ...(errCodeReviveReject !== undefined ? { code: errCodeReviveReject } : {}) });
                 if (reviveCycle !== undefined && deps.registry !== undefined && deps.taskId !== undefined) {
@@ -1692,7 +1693,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 catch (e) {
                     return {
                         isError: true,
-                        content: `Sub-agent not started: worktree isolation failed — ${e instanceof Error ? e.message : String(e)}. Retry without the isolation parameter, or fix the repository state.`,
+                        content: `Sub-agent not started: worktree isolation failed — ${thrownText(e)}. Retry without the isolation parameter, or fix the repository state.`,
                         details: { error: "isolation.failed" },
                     };
                 }
@@ -1711,7 +1712,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 }
                 catch (e) {
                     worktreeKeptPath = worktreeDir;
-                    return `worktree: ${worktreeDir} (cleanup check failed: ${e instanceof Error ? e.message : String(e)})`;
+                    return `worktree: ${worktreeDir} (cleanup check failed: ${thrownText(e)})`;
                 }
             };
             let injectedTools = [];
@@ -1845,7 +1846,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             let observerDegradedCount = 0;
             let observerDegradedFirst;
             const noteObserverFailure = (err) => {
-                const msg = (err instanceof Error ? err.message : String(err)).slice(0, REPORT_FIELD_MAX);
+                const msg = (thrownText(err)).slice(0, REPORT_FIELD_MAX);
                 if (observerPairing !== undefined && observerPairing.state === "armed") {
                     observerDegradedCount++;
                     if (observerDegradedFirst === undefined)
@@ -2362,7 +2363,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 }
                 catch (e) {
                     const wt = await finishWorktree();
-                    return { isError: true, content: `Sub-agent not started: session fork failed (${e instanceof Error ? e.message : String(e)}).${wt ? `\n${wt}` : ""}`, details: { error: "fork failed" } };
+                    return { isError: true, content: `Sub-agent not started: session fork failed (${thrownText(e)}).${wt ? `\n${wt}` : ""}`, details: { error: "fork failed" } };
                 }
                 if (!forkedId) {
                     const wt = await finishWorktree();
@@ -2414,7 +2415,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                             const wt = await finishWorktree();
                             return {
                                 isError: true,
-                                content: `Sub-agent not started in background: the delegation settlement account could not record the launch (${(e instanceof Error ? e.message : String(e)).slice(0, 300)}) — fail-closed; repair the memory control plane or retry.${wt ? `\n${wt}` : ""}`,
+                                content: `Sub-agent not started in background: the delegation settlement account could not record the launch (${(thrownText(e)).slice(0, 300)}) — fail-closed; repair the memory control plane or retry.${wt ? `\n${wt}` : ""}`,
                                 details: { error: "settlement_write_ahead_failed" },
                             };
                         }
@@ -2443,7 +2444,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                             }
                         }
                         if (!settled) {
-                            const detail = lastErr instanceof Error ? lastErr.message : String(lastErr);
+                            const detail = thrownText(lastErr);
                             try {
                                 enqueueMemoryAnnouncement(forkSettlementSeat.controlDir, {
                                     kind: "gate",
@@ -2490,7 +2491,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                             catch {
                             }
                         }
-                        return { isError: true, content: `Sub-agent not started in background: ${e instanceof Error ? e.message : String(e)}${wt ? `\n${wt}` : ""}`, details: { error: "register_failed" } };
+                        return { isError: true, content: `Sub-agent not started in background: ${thrownText(e)}${wt ? `\n${wt}` : ""}`, details: { error: "register_failed" } };
                     }
                     if (forkEntryGate.key !== undefined)
                         chargeDelegationEntryHandle(bg.registry, forkEntryGate.key, bg.agentStore, taskId);
@@ -2741,7 +2742,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         dropHostAbortListener();
                         void finishWorktree();
                         const killed = abort.signal.aborted;
-                        const msgFork = e instanceof Error ? e.message : String(e);
+                        const msgFork = thrownText(e);
                         const errCodeForkReject = killed ? undefined : thrownErrorCode(e);
                         const errClassForkReject = killed ? undefined : classifySubagentError({ kind: "failed", ...(errCodeForkReject !== undefined ? { code: errCodeForkReject } : {}) });
                         const settledBg = bg.registry.settleBackgroundAgent(taskId, {
@@ -2850,7 +2851,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     catch {
                     }
                     const wt = await finishWorktree();
-                    return { isError: true, content: `Fork failed: the forked run threw (${e instanceof Error ? e.message : String(e)}).${wt ? `\n${wt}` : ""}`, details: { error: "fork run failed" } };
+                    return { isError: true, content: `Fork failed: the forked run threw (${thrownText(e)}).${wt ? `\n${wt}` : ""}`, details: { error: "fork run failed" } };
                 }
                 finally {
                     syncForkAdmission.release();
@@ -2956,7 +2957,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         const wt = await finishWorktree();
                         return {
                             isError: true,
-                            content: `Sub-agent not started in background: the delegation settlement account could not record the launch (${(e instanceof Error ? e.message : String(e)).slice(0, 300)}) — fail-closed; repair the memory control plane or retry.${wt ? `\n${wt}` : ""}`,
+                            content: `Sub-agent not started in background: the delegation settlement account could not record the launch (${(thrownText(e)).slice(0, 300)}) — fail-closed; repair the memory control plane or retry.${wt ? `\n${wt}` : ""}`,
                             details: { error: "settlement_write_ahead_failed" },
                         };
                     }
@@ -2985,7 +2986,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         }
                     }
                     if (!settled) {
-                        const detail = lastErr instanceof Error ? lastErr.message : String(lastErr);
+                        const detail = thrownText(lastErr);
                         try {
                             enqueueMemoryAnnouncement(settlementSeat.controlDir, {
                                 kind: "gate",
@@ -3064,7 +3065,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         catch {
                         }
                     }
-                    return { isError: true, content: `Sub-agent not started in background: ${e instanceof Error ? e.message : String(e)}${wt ? `\n${wt}` : ""}`, details: { error: "register_failed" } };
+                    return { isError: true, content: `Sub-agent not started in background: ${thrownText(e)}${wt ? `\n${wt}` : ""}`, details: { error: "register_failed" } };
                 }
                 if (capLedgerKey !== undefined)
                     chargeDelegationEntryHandle(bg.registry, capLedgerKey, bg.agentStore, reviveRow === undefined ? taskId : undefined);
@@ -3281,7 +3282,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         }
                         catch {
                         }
-                        const msg = e instanceof Error ? e.message : String(e);
+                        const msg = thrownText(e);
                         throw new Error(disp === "rolled_back"
                             ? `parked resume rolled back — the approval is still pending (retryable): ${msg}`
                             : disp === "failed"
@@ -3609,7 +3610,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         else
                             bgRetainLedger?.markSettled(ctx.toolCallId);
                     }
-                    const msg = e instanceof Error ? e.message : String(e);
+                    const msg = thrownText(e);
                     const errCodeBgReject = killed ? undefined : thrownErrorCode(e);
                     const errClassBgReject = killed ? undefined : classifySubagentError({ kind: "failed", ...(errCodeBgReject !== undefined ? { code: errCodeBgReject } : {}) });
                     const settled = bg.registry.settleBackgroundAgent(taskId, {
@@ -3672,7 +3673,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     ]);
                     if (startup === "settled") {
                         if (parkedResume !== undefined) {
-                            const err = await bgChildPromise.then(() => undefined, (e) => (e instanceof Error ? e.message : String(e)));
+                            const err = await bgChildPromise.then(() => undefined, (e) => (thrownText(e)));
                             return {
                                 isError: true,
                                 content: `Parked resume did not complete: ${(err ?? "the resumed run settled before its delivery lane bound").slice(0, 600)}`,

package/dist/agents/teacher.js

@@ -6,6 +6,7 @@ import { mapNestedSuspend, isDurablePause } from "./suspend-guard.js";
 import { isDefineToolProduct, rebindDefineToolCtx, stampDefineToolBrand } from "../core/tools.js";
 import { delimitUntrusted, inlineUntrusted } from "../core/untrusted-text.js";
 import { buildCumulativeStats } from "./cumulative-stats.js";
+import { thrownLabel, thrownText } from "../core/thrown-value.js";
 export const TEACHER_PROMPT = `You are an expert advisor to a less-capable "student" agent that got stuck.
 You receive the task and the student's recent failed attempts. Your job is to help the student RECOVER,
 not to do the work for it.
@@ -97,7 +98,7 @@ export async function runWithTeacher(runner, studentSpec, teacher = {}) {
         catch (e) {
             if (isConfigCoded(e))
                 throw e;
-            discloseStoreIncident({ op: "find", error: String(e?.message ?? e) });
+            discloseStoreIncident({ op: "find", error: thrownText(e) });
             found = [];
         }
         let budget = 0;
@@ -143,7 +144,7 @@ export async function runWithTeacher(runner, studentSpec, teacher = {}) {
             catch (e) {
                 if (isConfigCoded(e))
                     throw e;
-                discloseStoreIncident({ op: "save", error: String(e?.message ?? e) });
+                discloseStoreIncident({ op: "save", error: thrownText(e) });
             }
         }
     }
@@ -218,7 +219,7 @@ async function runTeacherCore(runner, studentSpec, teacher) {
                         return out;
                     }
                     catch (e) {
-                        const errText = String(e);
+                        const errText = thrownLabel(e);
                         logTool(t.name, rawParams, `ERROR: ${errText}`);
                         onToolFail(t.name, errText);
                         throw e;
@@ -242,7 +243,7 @@ async function runTeacherCore(runner, studentSpec, teacher) {
                     return out;
                 }
                 catch (e) {
-                    const errText = String(e);
+                    const errText = thrownLabel(e);
                     logTool(t.name, args, `ERROR: ${errText}`);
                     onToolFail(t.name, errText);
                     throw e;

package/dist/brain/circuit-breaker.js

@@ -1,6 +1,7 @@
 import { createAssistantMessageEventStream } from "../internal/llm.js";
 import { BrainError, IN_BAND_OUTPUT_CODES, ZERO_USAGE, extractErrorCode } from "./errors.js";
 import { emitBrainStatus, emitBrainTelemetry } from "./status-sink.js";
+import { thrownText } from "../core/thrown-value.js";
 export const CIRCUIT_OPEN_MARKER = "circuit open for ";
 class InMemoryBreakerState {
     m = new Map();
@@ -147,7 +148,7 @@ export function createCircuitBreakerBrain(inner, opts = {}) {
                 out.push({
                     type: "error",
                     reason: aborted ? "aborted" : "error",
-                    error: errorAssistantMessage(model, code, e instanceof Error ? e.message : String(e), aborted ? "aborted" : "error"),
+                    error: errorAssistantMessage(model, code, thrownText(e), aborted ? "aborted" : "error"),
                 });
             }
         })();

package/dist/brain/degrading.js

@@ -1,6 +1,7 @@
 import { createAssistantMessageEventStream, } from "../internal/llm.js";
 import { ZERO_USAGE, extractErrorCode } from "./errors.js";
 import { CIRCUIT_OPEN_MARKER } from "./circuit-breaker.js";
+import { thrownText } from "../core/thrown-value.js";
 export const DEGRADED_DIAGNOSTIC_TYPE = "degraded";
 const VALID_REASONS = new Set([
     "breaker_open",
@@ -53,7 +54,7 @@ function errorMessageOf(model, e, aborted) {
         provider: model.provider,
         model: model.id,
         stopReason: aborted ? "aborted" : "error",
-        errorMessage: e instanceof Error ? e.message : String(e),
+        errorMessage: thrownText(e),
         usage: ZERO_USAGE,
         timestamp: Date.now(),
     };

package/dist/brain/errors.js

@@ -1,3 +1,4 @@
+import { thrownText } from "../core/thrown-value.js";
 export const ZERO_USAGE = {
     input: 0,
     output: 0,
@@ -81,12 +82,16 @@ const STALE_CONNECTION_CODES = new Set([
     "StreamSuspended",
 ]);
 function hasStaleConnectionCode(e) {
-    let cur = e;
-    for (let depth = 0; depth < 5 && cur !== undefined && cur !== null; depth++) {
-        const code = typeof cur.code === "string" ? cur.code : undefined;
-        if (code !== undefined && STALE_CONNECTION_CODES.has(code))
-            return true;
-        cur = cur instanceof Error ? cur.cause : undefined;
+    try {
+        let cur = e;
+        for (let depth = 0; depth < 5 && cur !== undefined && cur !== null; depth++) {
+            const code = typeof cur.code === "string" ? cur.code : undefined;
+            if (code !== undefined && STALE_CONNECTION_CODES.has(code))
+                return true;
+            cur = cur instanceof Error ? cur.cause : undefined;
+        }
+    }
+    catch {
     }
     return false;
 }
@@ -131,16 +136,20 @@ export function classifyConnectFailure(e) {
     return walkConnectFailure(e, { left: CONNECT_GRAPH_NODE_BUDGET }) === "deterministic" ? "deterministic" : "indeterminate";
 }
 export function describeNetworkError(e) {
-    const top = e instanceof Error ? e.message : String(e);
+    const top = thrownText(e);
     const parts = [];
-    let cur = e instanceof Error ? e.cause : undefined;
-    for (let depth = 0; depth < 4 && cur !== undefined && cur !== null; depth++) {
-        const code = typeof cur.code === "string" ? cur.code : undefined;
-        const msg = cur instanceof Error ? cur.message : String(cur);
-        const piece = code !== undefined && !msg.includes(code) ? `${code}: ${msg}` : msg;
-        if (piece.length > 0 && piece !== top && !parts.includes(piece))
-            parts.push(piece);
-        cur = cur instanceof Error ? cur.cause : undefined;
+    try {
+        let cur = e instanceof Error ? e.cause : undefined;
+        for (let depth = 0; depth < 4 && cur !== undefined && cur !== null; depth++) {
+            const code = typeof cur.code === "string" ? cur.code : undefined;
+            const msg = thrownText(cur);
+            const piece = code !== undefined && !msg.includes(code) ? `${code}: ${msg}` : msg;
+            if (piece.length > 0 && piece !== top && !parts.includes(piece))
+                parts.push(piece);
+            cur = cur instanceof Error ? cur.cause : undefined;
+        }
+    }
+    catch {
     }
     const body = parts.length > 0 ? `${top} (${parts.join(" ← ")})` : top;
     return hasStaleConnectionCode(e) ? `${body} — possibly a stale connection; a fresh one may succeed` : body;

package/dist/brain/failover.js

@@ -2,6 +2,7 @@ import { createAssistantMessageEventStream, } from "../internal/llm.js";
 import { extractErrorCode } from "./errors.js";
 import { emitBrainTelemetry } from "./status-sink.js";
 import { passthroughStream } from "./degrading.js";
+import { thrownText } from "../core/thrown-value.js";
 export function createFailoverBrain(brains) {
     if (brains.length === 0) {
         throw new Error("createFailoverBrain: need at least one brain");
@@ -73,7 +74,7 @@ export function createFailoverBrain(brains) {
                     provider: model.provider,
                     model: model.id,
                     stopReason: aborted ? "aborted" : "error",
-                    errorMessage: e instanceof Error ? e.message : String(e),
+                    errorMessage: thrownText(e),
                     usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } },
                     timestamp: Date.now(),
                 };