@visual-z/xeno 0.8.1 → 0.8.3

package/src/runtime/openai.ts

@@ -25,7 +25,10 @@ import type { AssistantBlock } from "../core/events.ts";
 import { assertNever } from "../core/exhaustive.ts";
 import { coherentTurn, type Provider, type ProviderConfig, type Turn, type ToolSchema, type OnDelta } from "./provider.ts";
 import { DEFAULT_COMPAT, type Compat, type Effort, type ModelSpec } from "./model.ts";
-import { withRetry, DEFAULT_RETRY, type RetryPolicy } from "./retry.ts";
+import { withRetry, retryLabel, DEFAULT_RETRY, type RetryPolicy } from "./retry.ts";
+import { ConnectionReuse } from "./connection-reuse.ts";
+import { watchIdle, type IdleWatch } from "./stream-idle.ts";
+
 import type { ProviderSendOptions } from "./provider-tool-policy.ts";
 
 /** One message as Chat Completions wants it. */
@@ -411,8 +414,10 @@ export class OpenAICompletionsProvider implements Provider {
   readonly config: ProviderConfig;
   private readonly apiKey: string;
   private readonly fetchImpl: typeof fetch;
+  private readonly connections = new ConnectionReuse();
   private readonly retry: RetryPolicy;
   private readonly onRetry: ((attempt: number, delayMs: number, error: unknown) => void) | undefined;
+  private readonly streamIdleMs: number | undefined;
 
   constructor(
     config: ProviderConfig,
@@ -421,6 +426,8 @@ export class OpenAICompletionsProvider implements Provider {
       fetchImpl?: typeof fetch;
       retry?: RetryPolicy;
       onRetry?: (attempt: number, delayMs: number, error: unknown) => void;
+      /** Silence after which one attempt is abandoned; tests shorten it (stream-idle.ts). */
+      streamIdleMs?: number;
     } = {},
   ) {
     this.config = config;
@@ -428,6 +435,7 @@ export class OpenAICompletionsProvider implements Provider {
     this.fetchImpl = options.fetchImpl ?? fetch;
     this.retry = options.retry ?? DEFAULT_RETRY;
     this.onRetry = options.onRetry;
+    this.streamIdleMs = options.streamIdleMs;
   }
 
   send(
@@ -441,12 +449,12 @@ export class OpenAICompletionsProvider implements Provider {
     // The clock starts inside the retried request, so a reported duration is
     // one attempt rather than the sum of the ones that failed.
     return withRetry(
-      () => this.attempt(frozen, messages, node, signal, onDelta, options),
+      () => watchIdle(signal, this.streamIdleMs, idle => this.attempt(frozen, messages, node, idle, onDelta, options)).catch((error: unknown) => { this.connections.note(error); throw error; }),
       this.retry,
       undefined,
       (attempt, delayMs, error) => {
         onDelta?.({ kind: "discard" });
-        onDelta?.({ kind: "retry", attempt, delayMs });
+        onDelta?.({ kind: "retry", attempt, delayMs, max: this.retry.maxRetries, reason: retryLabel(error) });
         this.onRetry?.(attempt, delayMs, error);
       },
       signal,
@@ -457,7 +465,7 @@ export class OpenAICompletionsProvider implements Provider {
     frozen: FrozenPrefix,
     messages: readonly Message[],
     node: number,
-    signal?: AbortSignal,
+    idle: IdleWatch,
     onDelta?: OnDelta,
     options?: ProviderSendOptions,
   ): Promise<Turn> {
@@ -487,10 +495,10 @@ export class OpenAICompletionsProvider implements Provider {
         authorization: `Bearer ${this.apiKey}`,
       },
       body: JSON.stringify(payload),
+      signal: idle.signal,
     };
-    if (signal !== undefined) init.signal = signal;
 
-    const response = await this.fetchImpl(`${baseUrl.replace(/\/$/, "")}/chat/completions`, init);
+    const response = await this.fetchImpl(`${baseUrl.replace(/\/$/, "")}/chat/completions`, this.connections.init(init));
 
     if (!response.ok) {
       const text = await response.text();
@@ -501,7 +509,7 @@ export class OpenAICompletionsProvider implements Provider {
       throw new Error(`${baseUrl} returned a streaming 200 with no body`);
     }
 
-    const assembled = await readCompletionsSse(response.body, onDelta);
+    const assembled = await readCompletionsSse(idle.body(response.body), onDelta);
     return coherentTurn(parseResponse(assembled, node, Date.now() - started), assembled.usage !== undefined);
   }
 }

package/src/runtime/permission-resources.ts

@@ -1,11 +1,18 @@
 /** R13: an indirect content reader must retain the same read-resource policy. */
-import { decideWithSessionRules, type PermissionAction, type PermissionRule } from "../core/permissions.ts";
+import { explainDecision, type DecisionExplanation, type PermissionAction, type PermissionRule } from "../core/permissions.ts";
 import { permissionPaths } from "../store/permission-paths.ts";
 
 export async function permissionResourceAction(root: string, path: string, configured: readonly PermissionRule[],
   remembered: readonly PermissionRule[] = [], tool = "read"): Promise<PermissionAction> {
+  return (await permissionResourceDecision(root, path, configured, remembered, tool)).action;
+}
+
+/** The same verdict, with the rule that produced it, for the durable approval record. */
+export async function permissionResourceDecision(root: string, path: string, configured: readonly PermissionRule[],
+  remembered: readonly PermissionRule[] = [], tool = "read"): Promise<DecisionExplanation> {
   const paths = await permissionPaths(root, [path]);
-  const read = decideWithSessionRules(configured, remembered, { tool: "read", paths });
-  const specific = decideWithSessionRules(configured, remembered, { tool, paths });
-  return read === "deny" || specific === "deny" ? "deny" : read === "ask" || specific === "ask" ? "ask" : "allow";
+  const read = explainDecision(configured, remembered, { tool: "read", paths });
+  const specific = explainDecision(configured, remembered, { tool, paths });
+  const rank = (action: PermissionAction) => action === "deny" ? 2 : action === "ask" ? 1 : 0;
+  return rank(specific.action) > rank(read.action) ? specific : read;
 }

package/src/runtime/pi-provider.ts

@@ -21,7 +21,10 @@ import { grokVersionHint } from "./oauth.ts";
 import type { ResolveEffects } from "./auth.ts";
 import { imageData } from "./images.ts";
 import { coherentTurn, FailedResponseError, type OnDelta, type Provider, type ProviderConfig, type ToolSchema, type Turn } from "./provider.ts";
-import { DEFAULT_RETRY, withRetry, type RetryPolicy } from "./retry.ts";
+import { DEFAULT_RETRY, retryLabel, withRetry, type RetryPolicy } from "./retry.ts";
+import { ConnectionReuse } from "./connection-reuse.ts";
+import { watchIdle, type IdleWatch } from "./stream-idle.ts";
+
 import { HttpError, StreamError } from "./openai.ts";
 import type { UsageSample } from "./usage.ts";
 import { disablePayloadTools, type ProviderSendOptions } from "./provider-tool-policy.ts";
@@ -197,7 +200,8 @@ function piModel(spec: ModelSpec, baseUrl: string): Model<Api> {
     contextWindow: spec.contextWindow ?? 131_072, maxTokens: spec.maxTokens ?? 16_000,
     cost: { input: spec.price?.input ?? 0, output: spec.price?.output ?? 0, cacheRead: spec.price?.cacheRead ?? 0, cacheWrite: spec.price?.cacheWrite ?? 0 },
     ...(spec.thinkingLevelMap ? { thinkingLevelMap: spec.thinkingLevelMap } : {}),
-    ...(spec.nativeCompat || spec.compat ? { compat: { ...spec.compat, ...spec.nativeCompat } } : {}),
+    ...(spec.nativeCompat || spec.compat || spec.api === "anthropic-messages"
+      ? { compat: { ...spec.compat, ...spec.nativeCompat, ...(spec.api === "anthropic-messages" ? { allowEmptySignature: true } : {}) } } : {}),
     ...(spec.samplingParams ? { samplingParams: spec.samplingParams } : {}) } as Model<Api>;
 }
 
@@ -214,6 +218,20 @@ function thinkingOf(raw: unknown): Extract<PiBlock, { type: "thinking" }> | null
   return null;
 }
 
+/**
+ * Reasoning never enters the visible channel. Pi turns thinking it cannot replay natively into a
+ * text part, and a model shown its own reasoning as earlier visible output starts writing its
+ * reasoning as visible output (an unsigned Gemini block via an Anthropic gateway snowballed into
+ * monologue in every later reply). An unsigned block here was sent that way by the server --
+ * interrupted streams throw and are never logged -- so anthropic-messages replays it verbatim
+ * (`allowEmptySignature` in piModel, as the native adapter does). Bedrock has no unsigned
+ * reasoning form, so there the block is dropped. Cross-model text conversion cannot occur: a
+ * model switch cuts the node (Session.switchModel) and every replayed message names this model.
+ */
+function replaysAsReasoning(api: Api, block: Extract<PiBlock, { type: "thinking" }>): boolean {
+  return api !== "bedrock-converse-stream" || block.redacted === true || !!block.thinkingSignature?.trim();
+}
+
 /** Pure conversion of an already hydrated projection; no second transcript is retained. */
 export function piContext(frozen: FrozenPrefix, messages: readonly Message[], spec: ModelSpec): Context {
   const out: PiMessage[] = [];
@@ -228,7 +246,7 @@ export function piContext(frozen: FrozenPrefix, messages: readonly Message[], sp
             const wire = record(block.wire) ? block.wire : {};
             content.push({ type: "text", text: block.text, ...(typeof wire["textSignature"] === "string" ? { textSignature: wire["textSignature"] } : {}) }); break;
           }
-          case "thinking": { const thinking = thinkingOf(block.raw); if (thinking) content.push(thinking); break; }
+          case "thinking": { const thinking = thinkingOf(block.raw); if (thinking && replaysAsReasoning(spec.api, thinking)) content.push(thinking); break; }
           case "tool_use": {
             names.set(block.id, block.name);
             const wire = record(block.wire) ? block.wire : {};
@@ -299,9 +317,12 @@ export function piBlocks(message: AssistantMessage, originalArguments: ReadonlyM
 export class PiProvider implements Provider {
   readonly config: ProviderConfig;
   private readonly apiKey: string;
+  private readonly connections = new ConnectionReuse();
   private readonly options: {
     fetch?: typeof fetch; effects?: ResolveEffects; oauth?: boolean; sessionId?: string;
     retry?: RetryPolicy; onRetry?: (attempt: number, delayMs: number, error: unknown) => void;
+    /** Silence after which one attempt is abandoned; tests shorten it (stream-idle.ts). */
+    streamIdleMs?: number;
   };
   constructor(config: ProviderConfig, apiKey: string, options: PiProvider["options"] = {}) {
     this.config = config; this.apiKey = apiKey; this.options = options;
@@ -310,14 +331,17 @@ export class PiProvider implements Provider {
   send(frozen: FrozenPrefix, messages: readonly Message[], node: number, signal?: AbortSignal, onDelta?: OnDelta, policy?: ProviderSendOptions): Promise<Turn> {
     // Bedrock's Pi adapter leaves retry ownership with the AWS SDK; never multiply that loop.
     const retry = this.options.retry ?? (this.config.spec.api === "bedrock-converse-stream" ? { ...DEFAULT_RETRY, maxRetries: 0 } : DEFAULT_RETRY);
-    return withRetry(() => this.attempt(frozen, messages, node, signal, onDelta, policy), retry, undefined,
-      (attempt, delayMs, error) => { onDelta?.({ kind: "discard" }); onDelta?.({ kind: "retry", attempt, delayMs }); this.options.onRetry?.(attempt, delayMs, error); }, signal);
+    return withRetry(() => watchIdle(signal, this.options.streamIdleMs, idle => this.attempt(frozen, messages, node, idle, signal, onDelta, policy)).catch((error: unknown) => { this.connections.note(error); throw error; }), retry, undefined,
+      (attempt, delayMs, error) => { onDelta?.({ kind: "discard" }); onDelta?.({ kind: "retry", attempt, delayMs, max: retry.maxRetries, reason: retryLabel(error) }); this.options.onRetry?.(attempt, delayMs, error); }, signal);
   }
 
-  private async attempt(frozen: FrozenPrefix, messages: readonly Message[], node: number, signal?: AbortSignal, onDelta?: OnDelta, policy?: ProviderSendOptions): Promise<Turn> {
+  private async attempt(frozen: FrozenPrefix, messages: readonly Message[], node: number, idle: IdleWatch, signal?: AbortSignal, onDelta?: OnDelta, policy?: ProviderSendOptions): Promise<Turn> {
     signal?.throwIfAborted();
     const started = Date.now();
-    const request = providerRequest(this.config.spec, this.apiKey, this.options.effects, this.options.fetch, this.options.oauth);
+    // Wrapped innermost: providerRequest rebuilds the call as a Request and
+    // passes no init, so a keepalive set any further out would be dropped.
+    const request = providerRequest(this.config.spec, this.apiKey, this.options.effects,
+      this.connections.wrap(this.options.fetch ?? globalThis.fetch), this.options.oauth);
     const model = piModel(this.config.spec, request.baseUrl);
     let status: number | undefined;
     let responseHeaders = new Headers();
@@ -334,8 +358,9 @@ export class PiProvider implements Provider {
       ...(this.options.sessionId === undefined ? {} : { sessionId: this.options.sessionId }),
       env: request.env, headers: request.headers, ...(nativeHttp ? {} : { fetch: observedFetch }), maxRetries: 0, transport: "sse",
       maxTokens: this.config.maxTokens, ...(this.config.effort !== "off" ? { reasoning: this.config.effort } : {}),
-      ...(signal ? { signal } : {}), onResponse: response => { status = response.status; responseHeaders = new Headers(response.headers); },
+      signal: idle.signal, onResponse: response => { idle.touch(); status = response.status; responseHeaders = new Headers(response.headers); },
       onProviderStreamEvent: event => {
+        idle.touch();
         originalArguments.observe(event);
         hasKnownUsage ||= nativeUsageReported(model.api, event);
       },
@@ -350,7 +375,7 @@ export class PiProvider implements Provider {
     // Pi emits fragments; xeno's progress contract replaces the displayed argument buffer.
     // Keep buffers per content block so interleaved calls and retries cannot share partial JSON.
     const toolArguments = new Map<number, string>();
-    for await (const event of APIS[model.api].streamSimple(model, normalizeContext(piContext(frozen, messages, this.config.spec)), options)) {
+    for await (const event of idle.events(APIS[model.api].streamSimple(model, normalizeContext(piContext(frozen, messages, this.config.spec)), options))) {
       switch (event.type) {
         case "text_delta": onDelta?.({ kind: "text", text: event.delta }); break;
         case "thinking_delta": onDelta?.({ kind: "thinking", text: event.delta }); break;

package/src/runtime/provider.ts

@@ -38,7 +38,10 @@ import { assertNever } from "../core/exhaustive.ts";
 import { isToolStopWithoutCall } from "../core/response-recovery.ts";
 import type { UsageSample } from "./usage.ts";
 import { type Effort, type ModelSpec, CLAUDE_OPUS_5 } from "./model.ts";
-import { withRetry, DEFAULT_RETRY, type RetryPolicy } from "./retry.ts";
+import { withRetry, retryLabel, DEFAULT_RETRY, type RetryPolicy } from "./retry.ts";
+import { ConnectionReuse } from "./connection-reuse.ts";
+import { watchIdle, type IdleWatch } from "./stream-idle.ts";
+
 import { anthropicOAuthHeaders } from "./oauth.ts";
 import { XENO_VERSION } from "./version.ts";
 import type { ProviderSendOptions } from "./provider-tool-policy.ts";
@@ -96,7 +99,9 @@ export type StreamDelta =
   | { kind: "text"; text: string }
   | { kind: "thinking"; text: string }
   | { kind: "tool"; id: string; name: string; arguments: string }
-  | { kind: "retry"; attempt: number; delayMs: number }
+  // `max` is the policy's budget and `reason` a few words from retryLabel;
+  // optional so a view written against the older shape still renders.
+  | { kind: "retry"; attempt: number; delayMs: number; max?: number; reason?: string }
   | { kind: "discard" };
 
 export type OnDelta = (delta: StreamDelta) => void;
@@ -228,6 +233,8 @@ function buildAnthropicClient(
 export class AnthropicProvider implements Provider {
   readonly config: ProviderConfig;
   private readonly client: AnthropicTransport;
+  private readonly connections = new ConnectionReuse();
+  private readonly streamIdleMs: number | undefined;
   private readonly retry: RetryPolicy;
   private readonly onRetry: ((attempt: number, delayMs: number, error: unknown) => void) | undefined;
 
@@ -247,6 +254,8 @@ export class AnthropicProvider implements Provider {
       fetch?: typeof fetch;
       /** OAuth access token: Bearer + oauth-2025-04-20, never x-api-key (D18). */
       oauth?: boolean;
+      /** Silence after which one attempt is abandoned; tests shorten it (stream-idle.ts). */
+      streamIdleMs?: number;
     } = {},
   ) {
     this.config = config;
@@ -256,9 +265,11 @@ export class AnthropicProvider implements Provider {
     // it, so the usage report would quietly stop adding up. The SDK timer
     // also ignores AbortSignal, so an outer wait is the only one Escape
     // can actually cancel.
-    this.client = options.client ?? buildAnthropicClient(apiKey, { ...options, ...(config.spec.baseUrl ? { baseUrl: config.spec.baseUrl } : {}) });
+    this.client = options.client ?? buildAnthropicClient(apiKey, { ...options, fetch: this.connections.wrap(options.fetch ?? fetch),
+      ...(config.spec.baseUrl ? { baseUrl: config.spec.baseUrl } : {}) });
     this.retry = options.retry ?? DEFAULT_RETRY;
     this.onRetry = options.onRetry;
+    this.streamIdleMs = options.streamIdleMs;
   }
 
   send(
@@ -270,14 +281,14 @@ export class AnthropicProvider implements Provider {
     options?: ProviderSendOptions,
   ): Promise<Turn> {
     return withRetry(
-      () => this.attempt(frozen, messages, node, signal, onDelta, options),
+      () => watchIdle(signal, this.streamIdleMs, idle => this.attempt(frozen, messages, node, idle, onDelta, options)).catch((error: unknown) => { this.connections.note(error); throw error; }),
       this.retry,
       undefined,
       (attempt, delayMs, error) => {
         // The next attempt starts from empty. Without this the UI concatenates
         // two openings of the same sentence and has no sign a retry happened.
         onDelta?.({ kind: "discard" });
-        onDelta?.({ kind: "retry", attempt, delayMs });
+        onDelta?.({ kind: "retry", attempt, delayMs, max: this.retry.maxRetries, reason: retryLabel(error) });
         this.onRetry?.(attempt, delayMs, error);
       },
       signal,
@@ -288,7 +299,7 @@ export class AnthropicProvider implements Provider {
     frozen: FrozenPrefix,
     messages: readonly Message[],
     node: number,
-    signal?: AbortSignal,
+    idle: IdleWatch,
     onDelta?: OnDelta,
     options?: ProviderSendOptions,
   ): Promise<Turn> {
@@ -322,11 +333,11 @@ export class AnthropicProvider implements Provider {
           : {}),
         messages: messages.map(toWireMessage),
       },
-      signal ? { signal } : undefined,
+      { signal: idle.signal },
     );
 
     const assembled = isAsyncIterable(response)
-      ? await consumeAnthropicStream(response, onDelta)
+      ? await consumeAnthropicStream(idle.events(response), onDelta)
       : {
           blocks: response.content.map(fromWireBlock),
           stopReason: response.stop_reason,

package/src/runtime/retry.ts

@@ -19,6 +19,7 @@
  */
 
 import { isContextOverflow } from "../core/overflow.ts";
+import type { FailureCause } from "../core/events.ts";
 
 /**
  * Words providers and relays use for "try again": timeouts, unavailable or
@@ -28,11 +29,123 @@ import { isContextOverflow } from "../core/overflow.ts";
  */
 const TRANSIENT_STREAM = /time[d ]?out|timed out|unavailable|overload|rate.?limit|too many requests|connection (?:reset|closed|refused)|ECONNRESET|temporar|\b5\d\d\b|internal.?server|bad gateway|service.?unavailable/i;
 
+/**
+ * Connection failures, named by code rather than guessed from prose.
+ *
+ * Bun's fetch reports every one of these as a plain Error carrying `code`
+ * (measured on 1.3.10: a reset before the headers, one halfway through the
+ * body and a refused port all arrive that way), never as the TypeError the
+ * WHATWG spec describes -- so the TypeError rule below never sees them. SDKs
+ * wrap the same error as `cause`. The two sets follow Claude Code's split:
+ * "stale" is a connection that existed and died, "network_down" is one that
+ * could never be opened. Both are worth another attempt.
+ */
+const STALE_CONNECTION_CODES = new Set([
+  "ECONNRESET", "EPIPE", "ECONNABORTED", "ETIMEDOUT", "ConnectionClosed",
+  "ERR_SOCKET_CLOSED", "UND_ERR_SOCKET", "UND_ERR_CLOSED",
+]);
+const NETWORK_DOWN_CODES = new Set([
+  "ECONNREFUSED", "ENOTFOUND", "ENETUNREACH", "ENETDOWN", "EHOSTUNREACH", "EHOSTDOWN",
+  "EAI_AGAIN", "ConnectionRefused", "FailedToOpenSocket", "ERR_PROXY_TUNNEL",
+]);
+
+/**
+ * The same failures in the words Bun, Node and undici use, for adapters that
+ * forward only the message (pi-ai turns a dropped stream into errorMessage
+ * and the code is gone by the time it reaches here).
+ */
+const STALE_CONNECTION_TEXT = /socket connection was closed unexpectedly|socket hang up|other side closed|\bECONNRESET\b|\bEPIPE\b/i;
+const NETWORK_DOWN_TEXT = /unable to connect\. is the computer able to access the url|\bECONNREFUSED\b|\bENOTFOUND\b|\bEAI_AGAIN\b/i;
+
+export type ConnectionFailure = "stale" | "network_down";
+
+function codeOf(value: unknown): string | undefined {
+  if (typeof value !== "object" || value === null) return undefined;
+  const code = (value as { code?: unknown }).code;
+  return typeof code === "string" ? code : undefined;
+}
+
+/** TLS verification codes from Node, Bun and undici; Claude Code also leaves these unretried. */
+const CERTIFICATE_CODE = /^(?:CERT_|UNABLE_TO_VERIFY_|UNABLE_TO_GET_ISSUER_CERT)|^(?:SELF_SIGNED_CERT_IN_CHAIN|DEPTH_ZERO_SELF_SIGNED_CERT|ERR_TLS_CERT_ALTNAME_INVALID)$/;
+
+function certificateFailure(error: unknown): boolean {
+  const cause = typeof error === "object" && error !== null ? (error as { cause?: unknown }).cause : undefined;
+  return [codeOf(error), codeOf(cause)].some((code) => code !== undefined && CERTIFICATE_CODE.test(code));
+}
+
+/**
+ * A few words for the retry line: what went wrong, not the full message.
+ * Bun's text runs to a sentence about `verbose: true`, which the status line
+ * cannot hold; the full message still reaches the user if the retries run out.
+ */
+export function retryLabel(error: unknown): string {
+  const status = statusOf(error);
+  if (status === 429) return "rate limited";
+  if (status !== undefined) return `HTTP ${status}`;
+  const connection = connectionFailure(error);
+  if (connection === "stale") return "connection lost";
+  if (connection === "network_down") return "network unreachable";
+  if (isStreamIdle(error)) return "stream stalled";
+  if (isMalformedResponse(error)) return "malformed response";
+  if (isStreamFailure(error)) return "stream error";
+  return error instanceof TypeError ? "connection failed" : "request failed";
+}
+
+/**
+ * What a failed request leaves in the log. `retries` is present only for a
+ * provider failure: it is what the adapter reported, not what the policy allowed.
+ * A harness error contributes its class name alone -- the message may quote a
+ * path, a command or a credential, and the class is chosen by code.
+ */
+export function failureCause(error: unknown, provider: { retries: number } | undefined): FailureCause {
+  if (provider) {
+    const status = statusOf(error);
+    return { source: "provider", label: retryLabel(error), ...(status === undefined ? {} : { status }), retries: provider.retries };
+  }
+  const name = error instanceof Error ? error.name : "";
+  return { source: "harness", label: /^[A-Za-z][\w.]{0,63}$/.test(name) ? name : "Error" };
+}
+
+/** The words a person reads: "HTTP 503 after 3 retries", "connection lost". */
+export function describeFailure(cause: FailureCause): string {
+  if (cause.source === "harness") return `xeno internal error (${cause.label})`;
+  const retries = cause.retries ?? 0;
+  return retries === 0 ? cause.label : `${cause.label} after ${retries} ${retries === 1 ? "retry" : "retries"}`;
+}
+
+/** Whether this error is a connection that died or one that never opened. */
+export function connectionFailure(error: unknown): ConnectionFailure | undefined {
+  const cause = typeof error === "object" && error !== null ? (error as { cause?: unknown }).cause : undefined;
+  for (const code of [codeOf(error), codeOf(cause)]) {
+    if (code === undefined) continue;
+    if (STALE_CONNECTION_CODES.has(code)) return "stale";
+    if (NETWORK_DOWN_CODES.has(code)) return "network_down";
+  }
+  for (const value of [error, cause]) {
+    if (!(value instanceof Error)) continue;
+    if (STALE_CONNECTION_TEXT.test(value.message)) return "stale";
+    if (NETWORK_DOWN_TEXT.test(value.message)) return "network_down";
+  }
+  return undefined;
+}
+
 /** Structural, so retry.ts need not import an adapter to recognise its error. */
 function isStreamFailure(error: unknown): error is Error & { code?: string } {
   return error instanceof Error && error.name === "StreamError";
 }
 
+/** stream-idle.ts StreamIdleError: an attempt abandoned after the stream went silent. */
+function isStreamIdle(error: unknown): boolean {
+  return error instanceof Error && error.name === "StreamIdleError";
+}
+
+/**
+ * Retries a silent stream gets. Fewer than the general budget because each
+ * one has already cost the idle limit (300s): ten would be fifty minutes.
+ * Codex CLI allows 5 stream retries and Claude Code 1; 2 is an assumption.
+ */
+const STREAM_IDLE_RETRIES = 2;
+
 /** provider.ts MalformedResponseError: a self-contradictory 200, structural for the same reason. */
 function isMalformedResponse(error: unknown): boolean {
   return error instanceof Error && error.name === "MalformedResponseError";
@@ -40,9 +153,12 @@ function isMalformedResponse(error: unknown): boolean {
 
 export interface RetryPolicy {
   /**
-   * Attempts after the first. Four means a request can take about 15s of
-   * backoff before failing, which covers a rate-limit window without making a
-   * broken request take a minute to report itself.
+   * Attempts after the first. Ten, doubling to a 32s ceiling, is Claude
+   * Code's budget: about 160s of backoff before failing. Four (~15s) gave up
+   * inside an ordinary network blip or proxy reconnect (Horizyn 2026-10-12,
+   * feat-retry-budget-and-progress). The wait is visible -- a countdown and
+   * attempt n/max -- and Escape ends it, so a longer budget is not a silent
+   * hang. The ceiling is an assumption carried over, not measured here.
    */
   maxRetries: number;
   /**
@@ -53,7 +169,18 @@ export interface RetryPolicy {
   maxRetryDelayMs: number;
 }
 
-export const DEFAULT_RETRY: RetryPolicy = { maxRetries: 4, maxRetryDelayMs: 60_000 };
+export const DEFAULT_RETRY: RetryPolicy = { maxRetries: 10, maxRetryDelayMs: 60_000 };
+
+/** Longest backoff between attempts when the server names no delay. */
+const BACKOFF_CEILING_MS = 32_000;
+
+/**
+ * 0.5s doubling to the ceiling, then flat. `jitter` in [0, 1) only shortens
+ * the wait, by at most a quarter (see retryDecision).
+ */
+function backoffMs(attempt: number, jitter: number): number {
+  return Math.min(500 * 2 ** attempt, BACKOFF_CEILING_MS) * (1 - jitter * 0.25);
+}
 
 export type RetryDecision =
   | { retry: true; delayMs: number }
@@ -140,6 +267,25 @@ export function retryDecision(
     return { retry: false, reason: "the prompt exceeds the model's context window" };
   }
 
+  // A certificate is the same on every attempt; retrying only delays the one
+  // message that sends the user to their proxy or CA bundle. Checked before
+  // the TypeError rule, which undici uses to wrap exactly this failure.
+  if (status === undefined && certificateFailure(error)) {
+    return { retry: false, reason: "the server's certificate could not be verified" };
+  }
+
+  if (isStreamIdle(error)) {
+    return attempt < STREAM_IDLE_RETRIES
+      ? { retry: true, delayMs: backoffMs(attempt, jitter) }
+      : { retry: false, reason: `the stream went silent ${attempt + 1} times` };
+  }
+
+  // A connection that died or never opened says nothing about the request,
+  // whichever wrapper carried it here.
+  if (status === undefined && connectionFailure(error) !== undefined) {
+    return { retry: true, delayMs: backoffMs(attempt, jitter) };
+  }
+
   // A provider that knows whether its own error is worth retrying gets the
   // last word, in both directions.
   // A failure reported inside a 200 stream carries no status. Relays and
@@ -151,8 +297,7 @@ export function retryDecision(
     if (isStreamFailure(error) && !TRANSIENT_STREAM.test(`${error.code ?? ""} ${error.message}`)) {
       return { retry: false, reason: "the stream reported a non-transient error" };
     }
-    const base = Math.min(0.5 * 2 ** attempt, 8) * 1000;
-    return { retry: true, delayMs: base * (1 - jitter * 0.25) };
+    return { retry: true, delayMs: backoffMs(attempt, jitter) };
   }
 
   const advice = headers?.get("x-should-retry");
@@ -188,9 +333,7 @@ export function retryDecision(
     return { retry: true, delayMs: requested };
   }
 
-  // 0.5s doubling to a ceiling of 8s, then flat.
-  const base = Math.min(0.5 * 2 ** attempt, 8) * 1000;
-  return { retry: true, delayMs: base * (1 - jitter * 0.25) };
+  return { retry: true, delayMs: backoffMs(attempt, jitter) };
 }
 
 export interface RetryEffects {

package/src/runtime/secrets.ts

@@ -0,0 +1,79 @@
+/**
+ * The session's live view of its secret vault (S.9). Rules and the inverse
+ * live in core/secrets.ts; this owns the mutable entries, their durable
+ * append, and the walk over an event's fields.
+ *
+ * One keeper per session tree: a branch shares its parent's, because both
+ * write the same log and a placeholder number must mean one value in it.
+ */
+import { expandText, isSolicitedSecret, mapStrings, placeholder, redactText, type SecretEntry } from "../core/secrets.ts";
+import type { LogEvent } from "../core/events.ts";
+import { appendVault, readVault } from "../store/secrets.ts";
+
+// Fields whose bytes a provider or the store verifies: rewriting them breaks
+// replay (signed thinking, raw provider blocks) or identity, and none of them
+// carries text a person typed or a tool printed.
+const VERIFIED_FIELDS = new Set(["id", "at", "raw", "wire", "signature", "replay_key", "sha256", "call_id", "user_id", "parent_call_id"]);
+
+export class SecretKeeper {
+  private entries: SecretEntry[] = [];
+  private pending: Promise<void> = Promise.resolve();
+
+  private readonly dir: string;
+  private readonly candidates: readonly { value: string; rule: string }[];
+
+  constructor(dir: string, candidates: readonly { value: string; rule: string }[] = []) {
+    this.dir = dir; this.candidates = candidates;
+  }
+
+  async load(): Promise<void> {
+    const stored = await readVault(this.dir);
+    // Entries this keeper already assigned (none before start) stay; stored ones fill in.
+    for (const entry of stored) if (!this.entries.some(known => known.n === entry.n)) this.entries.push(entry);
+  }
+
+  /**
+   * Returns the event to write and whether this call added vault entries. The
+   * entries are in memory at once -- the next event numbers after them -- and
+   * durable before the returned promise resolves, so no written event ever
+   * holds a placeholder the vault cannot expand.
+   */
+  async redact(event: LogEvent, previousAssistantText: string | undefined): Promise<{ event: LogEvent; added: number }> {
+    const added: SecretEntry[] = [];
+    const redact = (text: string): string => {
+      const result = redactText(text, [...this.entries, ...added], this.candidates);
+      added.push(...result.added);
+      return result.text;
+    };
+    const skip = (key: string) => VERIFIED_FIELDS.has(key);
+    let next: LogEvent;
+    if (event.t === "checkpoint") next = event; // file fingerprints and paths, never projected
+    else if (event.t === "assistant") {
+      // Thinking is replayed under the provider's signature; a changed byte is a rejected request.
+      next = { ...event, blocks: event.blocks.map(block => block.type === "thinking" ? block : mapStrings(block, redact, skip) as typeof block) };
+    } else if (event.t === "user" && isSolicitedSecret(event.text, previousAssistantText)) {
+      // The whole message is the credential, however short: it was asked for.
+      const value = event.text.trim();
+      const entry = this.entries.find(known => known.value === value) ??
+        { n: this.entries.reduce((max, known) => Math.max(max, known.n), 0) + 1, value, rule: "solicited" };
+      if (!this.entries.includes(entry)) added.push(entry);
+      next = { ...mapStrings(event, redact, key => skip(key) || key === "text") as LogEvent & { t: "user" }, text: placeholder(entry.n) };
+    } else next = mapStrings(event, redact, skip) as LogEvent;
+    if (added.length > 0) {
+      this.entries.push(...added);
+      const write = this.pending.then(() => appendVault(this.dir, added));
+      this.pending = write.catch(() => {});
+      await write;
+    }
+    return { event: next, added: added.length };
+  }
+
+  /** Tool input as the tool should run it: placeholders become values. */
+  expand(input: unknown): unknown {
+    return this.entries.length === 0 ? input : mapStrings(input, text => expandText(text, this.entries));
+  }
+}
+
+export const SECRET_GUIDANCE = "Values written as [[xeno-secret-N]] are credentials xeno hid from you. " +
+  "Use the placeholder exactly as written in tool inputs; xeno substitutes the real value when the tool runs " +
+  "and hides it again in the output. Do not ask the user to repeat a hidden value.";

package/src/runtime/session-control.ts

@@ -13,6 +13,8 @@ import type { Session, LoopEvent, RequestOptions } from "./loop.ts";
 import type { ApprovalChoice } from "./tools.ts";
 import { validateQuestionReply, type QuestionRequest, type QuestionReply } from "../core/question.ts";
 import type { QuestionSlot } from "./question-tool.ts";
+import { requestExternalEffects } from "./turn-effects.ts";
+import type { ExternalEffect } from "../core/external-effects.ts";
 
 export type ControlNotice = { method: string; params: { threadId: string; streamId: string; sequence: number; turnId?: string; [key: string]: unknown } };
 export type PendingApproval = { id: string; turnId: string; request: PermissionRequest };
@@ -41,6 +43,8 @@ export class SessionControl {
   private waiting: ControlSnapshot["waiting"] = null;
   private changing = false;
   private inputSource: ((phase: Phase) => Promise<UserInput | null>) | undefined;
+  /** What the last finished turn did outside the workspace, as sent with its turn/completed. */
+  lastExternalEffects: readonly ExternalEffect[] = [];
 
   constructor(session: Session) {
     this.session = session;
@@ -144,7 +148,11 @@ export class SessionControl {
           if (state?.request.event === active.id) outcome = state.execution;
         }
       } catch { /* unreadable storage stays unknown, never an invented completion */ }
-      this.emit("turn/completed", { ...(outcome ? { outcome } : {}), steeringUndelivered: active.queue.length });
+      // feat-external-effects-summary: a projection of this request's receipts, never a stored event.
+      let externalEffects: ExternalEffect[] = [];
+      try { externalEffects = requestExternalEffects(this.session); } catch { /* the list is advisory; a read failure shows none */ }
+      this.lastExternalEffects = externalEffects;
+      this.emit("turn/completed", { ...(outcome ? { outcome } : {}), steeringUndelivered: active.queue.length, externalEffects });
       this.active = null;
     }
   }