@the-open-engine/zeroshot 6.17.0 → 6.18.0

package/src/agent-cli-provider/adapters/gemini.ts

@@ -1,3 +1,9 @@
+import { randomUUID } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { UnsupportedProviderCapabilityError } from '../errors';
 import { appendJsonSchemaPrompt } from '../schema';
 import {
   getOrStringFromKeys,
@@ -16,7 +22,7 @@ import {
   type ModelCatalogEntry,
   type ModelLevel,
   type OutputEvent,
-  type ProviderAdapter,
+  type StructuredOutputRecoveryAdapter,
   type ProviderParserState,
   type ResolvedModelSpec,
   type WarningMetadata,
@@ -52,6 +58,7 @@ function detectCliFeatures(helpText?: string | null): GeminiCliFeatures {
     supportsAutoApprove: unknown ? true : /--yolo\b/.test(help),
     supportsCwd: unknown ? true : /--cwd\b/.test(help),
     supportsModel: unknown ? true : /\s-m\b/.test(help) || /--model\b/.test(help),
+    supportsAdminPolicy: !unknown && /--admin-policy\b/.test(help),
     unknown,
   };
 }
@@ -109,6 +116,75 @@ function buildCommand(context: string, options: BuildProviderCommandOptions = {}
   });
 }
 
+function standardAdminPolicyDirectory(): string {
+  if (process.platform === 'darwin') {
+    return '/Library/Application Support/GeminiCli/policies';
+  }
+  if (process.platform === 'win32') {
+    return path.join(process.env.ProgramData || 'C:\\ProgramData', 'gemini-cli', 'policies');
+  }
+  return '/etc/gemini-cli/policies';
+}
+
+function assertSupplementalAdminPolicyEffective(): void {
+  const directory = standardAdminPolicyDirectory();
+  let entries: fs.Dirent[];
+  try {
+    entries = fs.readdirSync(directory, { withFileTypes: true });
+  } catch (error) {
+    if (isRecord(error) && error.code === 'ENOENT') return;
+    throw new UnsupportedProviderCapabilityError(
+      'gemini',
+      'structuredOutputRecovery',
+      `Gemini structured-output recovery cannot inspect the standard admin-policy directory ${directory}; refuse a supplemental policy that may be ignored.`
+    );
+  }
+  if (!entries.some((entry) => entry.isFile() && entry.name.endsWith('.toml'))) return;
+  throw new UnsupportedProviderCapabilityError(
+    'gemini',
+    'structuredOutputRecovery',
+    `Gemini ignores --admin-policy when ${directory} contains TOML policies. Remove the conflict or use an administrator-managed deny-all policy before retrying.`
+  );
+}
+
+function writeRecoveryAdminPolicy(): string {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'zeroshot-gemini-policy-'));
+  const policyPath = path.join(directory, `${randomUUID()}.toml`);
+  fs.writeFileSync(policyPath, '[[rule]]\ntoolName = "*"\ndecision = "deny"\npriority = 999\n', {
+    flag: 'wx',
+    mode: 0o600,
+  });
+  return policyPath;
+}
+
+function buildStructuredOutputRecoveryCommand(
+  context: string,
+  options: BuildProviderCommandOptions = {}
+): CommandSpec {
+  if (optionFeatures(options).supportsAdminPolicy !== true) {
+    throw new UnsupportedProviderCapabilityError(
+      'gemini',
+      'structuredOutputRecovery',
+      'Gemini structured-output recovery requires CLI evidence for --admin-policy. Upgrade @google/gemini-cli before retrying.'
+    );
+  }
+  assertSupplementalAdminPolicyEffective();
+  const recoveryOptions = { ...options };
+  delete recoveryOptions.resumeSessionId;
+  delete recoveryOptions.continueSession;
+  const spec = buildCommand(context, { ...recoveryOptions, autoApprove: false });
+  const policyPath = writeRecoveryAdminPolicy();
+  return {
+    ...spec,
+    args: ['--admin-policy', policyPath, ...spec.args],
+    cleanup: [...(spec.cleanup || []), policyPath],
+    cleanupMetadata: [
+      ...spec.cleanupMetadata,
+      { kind: 'temp-file', provider: 'gemini', path: policyPath, reason: 'admin-policy' },
+    ],
+  };
+}
+
 function normalizeMessageContent(content: unknown): string {
   if (typeof content === 'string') return content;
   if (Array.isArray(content)) {
@@ -148,6 +224,11 @@ function parseToolUseEvent(
   };
 }
 
+function geminiErrorMessage(event: Record<string, unknown>, fallback: string): string {
+  const error = isRecord(event.error) ? event.error : null;
+  return (error && getString(error, 'message')) || getString(event, 'message') || fallback;
+}
+
 function parseToolResultEvent(
   event: Record<string, unknown>,
   state: ProviderParserState
@@ -157,20 +238,32 @@ function parseToolResultEvent(
     ['tool_call_id', 'tool_id', 'id'],
     state.lastToolId
   );
+  const isError = getString(event, 'status') === 'error';
   return {
     type: 'tool_result',
     toolId,
-    content: event.output ?? event.content ?? '',
-    isError: event.success === false,
+    content: event.output ?? (isError ? geminiErrorMessage(event, 'Tool failed') : ''),
+    isError,
   };
 }
 
 function parseResultEvent(event: Record<string, unknown>): OutputEvent {
+  const success = getString(event, 'status') === 'success';
   return {
     type: 'result',
-    success: event.success !== false,
+    success,
     result: event.result || '',
-    error: event.success === false ? (getString(event, 'error') ?? 'Result failed') : null,
+    error: success ? null : geminiErrorMessage(event, 'Result failed'),
+  };
+}
+
+function parseErrorEvent(event: Record<string, unknown>): OutputEvent | null {
+  if (getString(event, 'severity') !== 'error') return null;
+  return {
+    type: 'result',
+    success: false,
+    result: '',
+    error: getString(event, 'message') || 'Gemini CLI error',
   };
 }
 
@@ -189,6 +282,8 @@ function parseEvent(line: string, state: ProviderParserState): OutputEvent | nul
       return parseToolResultEvent(event, state);
     case 'result':
       return parseResultEvent(event);
+    case 'error':
+      return parseErrorEvent(event);
     default:
       return null;
   }
@@ -229,7 +324,7 @@ function classifyError(error: unknown): ErrorClassification {
   );
 }
 
-export const geminiAdapter: ProviderAdapter = {
+export const geminiAdapter: StructuredOutputRecoveryAdapter = {
   id: 'gemini',
   displayName: 'Gemini',
   binary: 'gemini',
@@ -242,6 +337,7 @@ export const geminiAdapter: ProviderAdapter = {
   defaultMinLevel: 'level1',
   detectCliFeatures,
   buildCommand,
+  buildStructuredOutputRecoveryCommand,
   parseEvent,
   createParserState: () => createParserState('gemini'),
   resolveModelSpec,

package/src/agent-cli-provider/adapters/opencode.ts

@@ -1,4 +1,8 @@
 import { contractError } from '../contract-errors';
+import { randomUUID } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
 import { UnsupportedProviderCapabilityError } from '../errors';
 import { appendJsonSchemaPrompt } from '../schema';
 import {
@@ -15,7 +19,7 @@ import {
   type ErrorClassification,
   type OpencodeCliFeatures,
   type OutputEvent,
-  type ProviderAdapter,
+  type StructuredOutputRecoveryAdapter,
   type WarningMetadata,
 } from '../types';
 import {
@@ -49,7 +53,9 @@ function detectCliFeatures(
     supportsCwd: unknown ? false : /--cwd\b/.test(help),
     supportsAutoApprove: false,
     supportsResume: !unknown && /--session\b/.test(help) && /--continue\b/.test(help),
+    supportsAgent: !unknown && /--agent\b/.test(help),
     supportsWebSearch: isCliVersionAtLeast(versionText, '1.0.137'),
+    supportsRecoveryIsolation: isCliVersionAtLeast(versionText, '1.17.20'),
     unknown,
   };
 }
@@ -162,6 +168,82 @@ function buildCommand(context: string, options: BuildProviderCommandOptions = {}
   });
 }
 
+function buildStructuredOutputRecoveryCommand(
+  context: string,
+  options: BuildProviderCommandOptions = {}
+): CommandSpec {
+  const features = optionFeatures(options);
+  if (features.supportsAgent !== true || features.supportsRecoveryIsolation !== true) {
+    throw new UnsupportedProviderCapabilityError(
+      'opencode',
+      'structuredOutputRecovery',
+      'OpenCode structured-output recovery requires CLI evidence for --agent and isolation controls available in OpenCode >= 1.17.20. Upgrade OpenCode before retrying.'
+    );
+  }
+  const agentName = `zeroshot-output-reformatter-${randomUUID()}`;
+  const profile = {
+    description: 'Convert supplied text to schema-valid JSON without external actions',
+    mode: 'primary',
+    permission: { '*': 'deny' },
+    tools: { '*': false },
+  };
+  const recoveryOptions = { ...options };
+  delete recoveryOptions.resumeSessionId;
+  delete recoveryOptions.continueSession;
+  const isolatedConfigHome = fs.mkdtempSync(path.join(os.tmpdir(), 'zeroshot-opencode-config-'));
+
+  try {
+    const spec = buildCommand(context, {
+      ...recoveryOptions,
+      agentName,
+      autoApprove: false,
+      webSearch: false,
+    });
+    const restrictedConfig = {
+      default_agent: agentName,
+      permission: { '*': 'deny' },
+      tools: { '*': false },
+      agent: { [agentName]: profile },
+      mode: { [agentName]: profile },
+      mcp: {},
+      instructions: [],
+      plugin: [],
+      command: {},
+    };
+    return {
+      ...spec,
+      env: {
+        ...spec.env,
+        ZEROSHOT_OPENCODE_AGENT: agentName,
+        XDG_CONFIG_HOME: isolatedConfigHome,
+        OPENCODE_DB: ':memory:',
+        OPENCODE_CONFIG: '',
+        OPENCODE_CONFIG_DIR: isolatedConfigHome,
+        OPENCODE_CONFIG_CONTENT: JSON.stringify(restrictedConfig),
+        OPENCODE_PERMISSION: JSON.stringify({ '*': 'deny' }),
+        OPENCODE_DISABLE_PROJECT_CONFIG: '1',
+        OPENCODE_PURE: '1',
+        OPENCODE_DISABLE_DEFAULT_PLUGINS: '1',
+        OPENCODE_DISABLE_EXTERNAL_SKILLS: '1',
+        OPENCODE_DISABLE_CLAUDE_CODE: '1',
+      },
+      cleanup: [...(spec.cleanup || []), isolatedConfigHome],
+      cleanupMetadata: [
+        ...(spec.cleanupMetadata || []),
+        {
+          kind: 'temp-directory',
+          provider: 'opencode',
+          path: isolatedConfigHome,
+          reason: 'isolated-config',
+        },
+      ],
+    };
+  } catch (error) {
+    fs.rmSync(isolatedConfigHome, { recursive: true, force: true });
+    throw error;
+  }
+}
+
 function parseToolPart(part: Record<string, unknown>): OutputEvent | null {
   const state = getRecord(part, 'state') ?? {};
   const status = getString(state, 'status');
@@ -262,7 +344,7 @@ function classifyError(error: unknown): ErrorClassification {
   return classifyBaseProviderError(error, [], []);
 }
 
-export const opencodeAdapter: ProviderAdapter = {
+export const opencodeAdapter: StructuredOutputRecoveryAdapter = {
   id: 'opencode',
   displayName: 'Opencode',
   binary: 'opencode',
@@ -281,6 +363,7 @@ export const opencodeAdapter: ProviderAdapter = {
   defaultMinLevel: 'level1',
   detectCliFeatures,
   buildCommand,
+  buildStructuredOutputRecoveryCommand,
   extractSessionId,
   parseEvent,
   createParserState: () => createParserState('opencode'),

package/src/agent-cli-provider/contract-options.ts

@@ -24,6 +24,9 @@ const CLI_FEATURE_FIELDS = [
   'supportsModel',
   'supportsEffort',
   'supportsSettings',
+  'supportsTools',
+  'supportsStrictMcpConfig',
+  'supportsNoSessionPersistence',
   'supportsJson',
   'supportsOutputSchema',
   'supportsDir',
@@ -31,8 +34,16 @@ const CLI_FEATURE_FIELDS = [
   'supportsConfigOverride',
   'supportsSkipGitRepoCheck',
   'supportsVariant',
+  'supportsSandbox',
+  'supportsEphemeral',
+  'supportsIgnoreUserConfig',
+  'supportsIgnoreRules',
+  'supportsStrictConfig',
   'supportsJsonMode',
+  'supportsAdminPolicy',
   'supportsNoSession',
+  'supportsAgent',
+  'supportsRecoveryIsolation',
   'supportsNoExtensions',
   'supportsNoSkills',
   'supportsNoPromptTemplates',
@@ -229,6 +240,11 @@ function normalizeBuildOptions(value: Record<string, unknown>): BuildProviderCom
     'strictSchema',
     optionalBooleanValue(value.strictSchema, 'options.strictSchema')
   );
+  addDefined(
+    result,
+    'structuredOutputRecovery',
+    optionalBooleanValue(value.structuredOutputRecovery, 'options.structuredOutputRecovery')
+  );
   addDefined(
     result,
     'gateway',

package/src/agent-cli-provider/index.ts

@@ -53,6 +53,7 @@ export {
   providerRegistry,
   resolveProviderCommand,
   supportsProviderCapability,
+  supportsProviderOutputReformatting,
 } from './provider-registry';
 
 export type {
@@ -93,6 +94,9 @@ export type {
   ProviderCliFeatures,
   ProviderId,
   ProviderRegistryEntry,
+  StructuredOutputRecoveryAdapter,
+  StructuredOutputProviderRegistryEntry,
+  UnstructuredOutputProviderRegistryEntry,
   RedactionMetadata,
   ReasoningEffort,
   ResolvedGatewayBuildOptions,

package/src/agent-cli-provider/provider-registry.ts

@@ -8,7 +8,7 @@ import { opencodeAdapter } from './adapters/opencode';
 import { ompAdapter } from './adapters/omp';
 import { piAdapter } from './adapters/pi';
 import { resolveClaudeCommand } from './claude-command';
-import type { ModelLevel, ProviderAdapter } from './types';
+import type { ModelLevel, ProviderAdapter, StructuredOutputRecoveryAdapter } from './types';
 
 export type ProviderCapabilityState = boolean | 'experimental';
 
@@ -69,7 +69,7 @@ export interface ProviderDockerMetadata {
   readonly install?: string;
 }
 
-export interface ProviderRegistryEntry {
+interface ProviderRegistryEntryBase {
   readonly id: string;
   readonly aliases: readonly string[];
   readonly displayName: string;
@@ -84,7 +84,6 @@ export interface ProviderRegistryEntry {
   readonly settingsDefaults?: Readonly<Record<string, unknown>>;
   readonly settingsValidator?: (settings: Record<string, unknown>) => string | null;
   readonly availabilityProbe?: 'command' | 'help-or-version';
-  readonly capabilities: ProviderCapabilities;
   readonly docs: ProviderDocsMetadata;
   readonly docker: ProviderDockerMetadata;
   readonly defaultLevels: Readonly<{
@@ -92,9 +91,26 @@ export interface ProviderRegistryEntry {
     readonly default: ModelLevel;
     readonly max: ModelLevel;
   }>;
+}
+
+export interface StructuredOutputProviderRegistryEntry extends ProviderRegistryEntryBase {
+  readonly capabilities: Omit<ProviderCapabilities, 'jsonSchema'> & {
+    readonly jsonSchema: true | 'experimental';
+  };
+  readonly adapter: StructuredOutputRecoveryAdapter;
+}
+
+export interface UnstructuredOutputProviderRegistryEntry extends ProviderRegistryEntryBase {
+  readonly capabilities: Omit<ProviderCapabilities, 'jsonSchema'> & {
+    readonly jsonSchema: false;
+  };
   readonly adapter: ProviderAdapter;
 }
 
+export type ProviderRegistryEntry =
+  | StructuredOutputProviderRegistryEntry
+  | UnstructuredOutputProviderRegistryEntry;
+
 const STANDARD_CAPABILITIES: Readonly<
   Pick<
     ProviderCapabilities,
@@ -590,3 +606,7 @@ export function supportsProviderCapability(
 ): boolean {
   return getProviderRegistryEntry(name).capabilities[capability] === true;
 }
+
+export function supportsProviderOutputReformatting(name: string): boolean {
+  return getProviderRegistryEntry(name).capabilities.jsonSchema !== false;
+}

package/src/agent-cli-provider/single-agent-runtime.ts

@@ -6,6 +6,7 @@ import {
   getProviderRegistryEntry,
   resolveProviderCommand,
   supportsProviderCapability,
+  supportsProviderOutputReformatting,
 } from './provider-registry';
 import type {
   BuildProviderCommandOptions,
@@ -16,6 +17,7 @@ import type {
   ModelLevel,
   ModelSpec,
   ProviderAdapter,
+  StructuredOutputRecoveryAdapter,
   ProviderCliFeatures,
   ProviderId,
   ResolvedGatewayBuildOptions,
@@ -106,7 +108,9 @@ export function prepareSingleAgentProviderCommand(
     adapter.id,
     baseOptions.cwd ?? process.cwd()
   );
-  const requestedWebSearch = baseOptions.webSearch ?? providerSettings.webSearch;
+  const requestedWebSearch = baseOptions.structuredOutputRecovery
+    ? recoveryWebSearchOption(adapter)
+    : (baseOptions.webSearch ?? providerSettings.webSearch);
   assertWebSearchDeclared(adapter.id, requestedWebSearch);
   const cliFeatures = resolveRuntimeCliFeatures(
     adapter.id,
@@ -125,10 +129,37 @@ export function prepareSingleAgentProviderCommand(
     configuration: {
       webSearch: webSearchAttestation(options),
     },
-    commandSpec: adapter.buildCommand(input.context, options),
+    commandSpec: buildRuntimeCommand(adapter, input.context, options),
   };
 }
 
+function buildRuntimeCommand(
+  adapter: ProviderAdapter,
+  context: string,
+  options: BuildProviderCommandOptions
+): CommandSpec {
+  if (options.structuredOutputRecovery !== true) {
+    return adapter.buildCommand(context, options);
+  }
+  if (!supportsProviderOutputReformatting(adapter.id)) {
+    throw new UnsupportedProviderCapabilityError(
+      adapter.id,
+      'structuredOutputRecovery',
+      `Provider ${adapter.id} does not advertise structured-output recovery.`
+    );
+  }
+  const recoveryAdapter = adapter as ProviderAdapter &
+    Partial<StructuredOutputRecoveryAdapter>;
+  if (typeof recoveryAdapter.buildStructuredOutputRecoveryCommand !== 'function') {
+    throw new UnsupportedProviderCapabilityError(
+      adapter.id,
+      'structuredOutputRecovery',
+      `Provider ${adapter.id} advertises structured output without a recovery adapter. Upgrade Zeroshot before retrying.`
+    );
+  }
+  return recoveryAdapter.buildStructuredOutputRecoveryCommand(context, options);
+}
+
 export function detectRuntimeProviderCliFeatures(provider: string): ProviderCliFeatures {
   return probeRuntimeProviderCli(provider).capabilities;
 }
@@ -262,15 +293,26 @@ function buildRuntimeOptions(
     providerSettings,
     modelSpec
   );
-  const webSearch = baseOptions.webSearch ?? providerSettings.webSearch;
+  const webSearch = baseOptions.structuredOutputRecovery
+    ? recoveryWebSearchOption(adapter)
+    : (baseOptions.webSearch ?? providerSettings.webSearch);
   assertWebSearchDeclared(adapter.id, webSearch);
-  const resolved = {
+  const baseResolved = {
     ...baseOptions,
     modelSpec,
     ...(gateway === undefined ? {} : { gateway }),
     ...(webSearch === undefined ? {} : { webSearch }),
     cliFeatures: runtime.cliFeatures,
   };
+  const resolved = { ...baseResolved };
+  if (baseOptions.structuredOutputRecovery) {
+    delete resolved.resumeSessionId;
+    delete resolved.continueSession;
+    delete resolved.mcpConfig;
+    resolved.autoApprove = false;
+    if (recoveryWebSearchOption(adapter) === undefined) delete resolved.webSearch;
+    else resolved.webSearch = false;
+  }
   if (baseOptions.jsonSchema && !supportsProviderCapability(adapter.id, 'jsonSchema')) {
     if (!shouldIncludeAuthEnv(baseOptions, runtime.authEnv)) {
       return { ...resolved, strictSchema: false };
@@ -281,6 +323,10 @@ function buildRuntimeOptions(
   return { ...resolved, authEnv: runtime.authEnv };
 }
 
+function recoveryWebSearchOption(adapter: ProviderAdapter): false | undefined {
+  return getProviderRegistryEntry(adapter.id).capabilities.webSearch === false ? undefined : false;
+}
+
 function resolveRuntimeGatewayOptions(
   provider: ProviderId,
   baseOptions: BuildProviderCommandOptions,

package/src/agent-cli-provider/types.ts

@@ -9,6 +9,8 @@ import type {
   ProviderDocsMetadata,
   ProviderInvokeSpec,
   ProviderRegistryEntry,
+  StructuredOutputProviderRegistryEntry,
+  UnstructuredOutputProviderRegistryEntry,
 } from './provider-registry';
 
 export type ProviderId = (typeof providerIds)[number];
@@ -27,8 +29,9 @@ export type {
   ProviderDocsMetadata,
   ProviderInvokeSpec,
   ProviderRegistryEntry,
+  StructuredOutputProviderRegistryEntry,
+  UnstructuredOutputProviderRegistryEntry,
 };
-
 export interface AgentCliProviderHelperMetadata {
   readonly packageName: '@the-open-engine/zeroshot';
   readonly buildOutputDir: 'lib/agent-cli-provider';
@@ -105,6 +108,9 @@ export interface ClaudeCliFeatures extends BaseCliFeatures {
   readonly supportsSettings: boolean;
   readonly supportsMcpConfig: boolean;
   readonly supportsResume: boolean;
+  readonly supportsTools: boolean;
+  readonly supportsStrictMcpConfig: boolean;
+  readonly supportsNoSessionPersistence: boolean;
 }
 
 export interface CodexCliFeatures extends BaseCliFeatures {
@@ -118,6 +124,11 @@ export interface CodexCliFeatures extends BaseCliFeatures {
   readonly supportsSkipGitRepoCheck: boolean;
   readonly supportsResume: boolean;
   readonly supportsWebSearch: boolean;
+  readonly supportsSandbox: boolean;
+  readonly supportsEphemeral: boolean;
+  readonly supportsIgnoreUserConfig: boolean;
+  readonly supportsIgnoreRules: boolean;
+  readonly supportsStrictConfig: boolean;
 }
 
 export interface GeminiCliFeatures extends BaseCliFeatures {
@@ -126,6 +137,7 @@ export interface GeminiCliFeatures extends BaseCliFeatures {
   readonly supportsAutoApprove: boolean;
   readonly supportsCwd: boolean;
   readonly supportsModel: boolean;
+  readonly supportsAdminPolicy: boolean;
 }
 
 export interface OpencodeCliFeatures extends BaseCliFeatures {
@@ -138,6 +150,8 @@ export interface OpencodeCliFeatures extends BaseCliFeatures {
   readonly supportsAutoApprove: false;
   readonly supportsResume: boolean;
   readonly supportsWebSearch: boolean;
+  readonly supportsAgent: boolean;
+  readonly supportsRecoveryIsolation: boolean;
 }
 
 export interface PiCliFeatures extends BaseCliFeatures {
@@ -215,6 +229,9 @@ export interface CliFeatureOverrides {
   readonly supportsIncludePartials?: boolean;
   readonly supportsVerbose?: boolean;
   readonly supportsModel?: boolean;
+  readonly supportsTools?: boolean;
+  readonly supportsStrictMcpConfig?: boolean;
+  readonly supportsNoSessionPersistence?: boolean;
   readonly supportsEffort?: boolean;
   readonly supportsSettings?: boolean;
   readonly supportsJson?: boolean;
@@ -223,12 +240,20 @@ export interface CliFeatureOverrides {
   readonly supportsCwd?: boolean;
   readonly supportsConfigOverride?: boolean;
   readonly supportsSkipGitRepoCheck?: boolean;
+  readonly supportsSandbox?: boolean;
+  readonly supportsEphemeral?: boolean;
+  readonly supportsIgnoreUserConfig?: boolean;
+  readonly supportsIgnoreRules?: boolean;
+  readonly supportsStrictConfig?: boolean;
   readonly supportsVariant?: boolean;
+  readonly supportsAdminPolicy?: boolean;
   readonly supportsJsonMode?: boolean;
   readonly supportsNoSession?: boolean;
   readonly supportsNoExtensions?: boolean;
   readonly supportsNoSkills?: boolean;
   readonly supportsNoPromptTemplates?: boolean;
+  readonly supportsAgent?: boolean;
+  readonly supportsRecoveryIsolation?: boolean;
   readonly supportsNoContextFiles?: boolean;
   readonly supportsNoApprove?: boolean;
   readonly supportsModeJson?: boolean;
@@ -262,7 +287,7 @@ export interface CleanupMetadata {
   readonly kind: 'temp-file' | 'temp-directory';
   readonly provider: ProviderId;
   readonly path: string;
-  readonly reason: 'output-schema' | 'settings-overlay';
+  readonly reason: 'output-schema' | 'settings-overlay' | 'admin-policy' | 'isolated-config';
 }
 
 export interface WarningMetadata {
@@ -312,6 +337,8 @@ export interface BuildProviderCommandOptions {
   // one variadic `--mcp-config` followed by file paths; adapters such as Copilot accept repeated
   // flags with inline JSON so configs survive container path translation.
   readonly mcpConfig?: readonly string[];
+  /** Internal profile for provider-neutral structured-output correction turns. */
+  readonly structuredOutputRecovery?: boolean;
 }
 
 export interface TextEvent {
@@ -415,6 +442,13 @@ export interface ProviderAdapter {
   classifyError(error: unknown): ErrorClassification;
 }
 
+export interface StructuredOutputRecoveryAdapter extends ProviderAdapter {
+  buildStructuredOutputRecoveryCommand(
+    context: string,
+    options?: BuildProviderCommandOptions
+  ): CommandSpec;
+}
+
 export class InvalidProviderModelError extends Error {
   readonly permanent = true;
 

package/src/agent-wrapper.js

@@ -586,8 +586,8 @@ class AgentWrapper {
    * Falls back to reformatting if extraction fails
    * @private
    */
-  _parseResultOutput(output) {
-    return parseResultOutput(this, output);
+  _parseResultOutput(output, options = {}) {
+    return parseResultOutput(this, output, options);
   }
 
   /**

package/src/cluster/errors.ts

@@ -13,6 +13,7 @@ export class ClusterInternalError extends ClusterError {}
 export class ClusterProtocolError extends ClusterError {}
 export class ClusterTransportError extends ClusterError {}
 export class ClusterTimeoutError extends ClusterError {}
+export class ClusterRequestError extends ClusterError {}
 
 export function requestAbortError(method: string): DOMException {
   return new DOMException(

package/src/cluster/index.ts

@@ -5,11 +5,15 @@ export {
   ClusterError,
   ClusterInternalError,
   ClusterProtocolError,
+  ClusterRequestError,
   ClusterRpcError,
   ClusterStateError,
   ClusterTimeoutError,
   ClusterTransportError,
 } from './errors.js';
+export { assertGraphProfile, assertGraphProfileSupported, assertGraphSpec } from './validators.js';
+export * from './payload-value.js';
+export * from './json-source.js';
 export { CONNECTION_TRANSITIONS, PROTOCOL_DIAGNOSTIC_CAPACITY, Connection } from './connection.js';
 export type {
   CallOptions,