@vtxmacro/cli 2026.10.59 → 2026.10.60

package/bin/exo-harness.ts

@@ -1551,6 +1551,19 @@ var runtime_policy_generated_default = {
     error_details: {
       review_failure_message_max_length: 220
     }
+  },
+  llm: {
+    provider_diagnostics: {
+      reply_body_max_chars: 65536,
+      reply_max_headers: 64,
+      reply_header_name_parts: [
+        "retry-after",
+        "ratelimit",
+        "rate-limit",
+        "quota",
+        "balance"
+      ]
+    }
   }
 };
 

package/bin/vtx-mcp.js

@@ -43,7 +43,7 @@ var init_define_VTX_PI_MODEL_POLICY = __esm({
 var agent_cli_release_default;
 var init_agent_cli_release = __esm({
   "agent-cli-release.json"() {
-    agent_cli_release_default = { package_name: "@vtxmacro/cli", package_version: "2026.10.59", codex_package_name: "@openai/codex", codex_version: "0.155.0", copilot_sdk_package_name: "@github/copilot-sdk", copilot_sdk_version: "1.0.0-beta.8", copilot_cli_package_name: "@github/copilot", copilot_cli_version: "1.0.80", deepseek_harness_version: "0.1.1-rc.2", deepseek_harness_packages: ["@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-agent-loop", "@deepseek-ai/dsh-agent-spine-demo", "@deepseek-ai/dsh-anonymous-user-id", "@deepseek-ai/dsh-atomic-write", "@deepseek-ai/dsh-attachment", "@deepseek-ai/dsh-brand", "@deepseek-ai/dsh-code-runtime", "@deepseek-ai/dsh-credentials", "@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-goal", "@deepseek-ai/dsh-goal-round-driver", "@deepseek-ai/dsh-home-paths", "@deepseek-ai/dsh-invariants", "@deepseek-ai/dsh-jobs", "@deepseek-ai/dsh-jobs-local", "@deepseek-ai/dsh-launch-environment", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-llm-deepseek", "@deepseek-ai/dsh-llm-retry", "@deepseek-ai/dsh-output-retention", "@deepseek-ai/dsh-sandbox", "@deepseek-ai/dsh-sandbox-policy", "@deepseek-ai/dsh-scope", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-session-checkpoint-policy", "@deepseek-ai/dsh-session-persistence", "@deepseek-ai/dsh-session-persistence-jsonl", "@deepseek-ai/dsh-session-projection", "@deepseek-ai/dsh-session-title", "@deepseek-ai/dsh-settings", "@deepseek-ai/dsh-shell", "@deepseek-ai/dsh-shell-env", "@deepseek-ai/dsh-skill", "@deepseek-ai/dsh-skill-filesystem", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt", "@deepseek-ai/dsh-timeout", "@deepseek-ai/dsh-tool-bash", "@deepseek-ai/dsh-tool-goal", "@deepseek-ai/dsh-tool-jobs", "@deepseek-ai/dsh-tool-skill", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-user-approval"], deepseek_cordis_package_name: "@deepseek-ai/cordis", deepseek_cordis_version: "4.0.1", deepseek_support_packages: { "@deepseek-ai/cordis-plugin-timer": "1.1.3" }, platforms: { "linux-x64": { package_name: "@openai/codex-linux-x64", target: "x86_64-unknown-linux-musl", binary_name: "codex", sha256: "660e159a49e823ac8e5986cb238f73158ce4b957d40d9292f8de90862644b501" }, "win32-x64": { package_name: "@openai/codex-win32-x64", target: "x86_64-pc-windows-msvc", binary_name: "codex.exe", sha256: "e4c11374bd9de8ad5c3b7617fd4654bb7839901edb0863f9930666863c7a021b" } }, pi_coding_agent_package_name: "@earendil-works/pi-coding-agent", pi_ai_package_name: "@earendil-works/pi-ai", pi_version: "0.85.1", pi_support_packages: ["@earendil-works/pi-agent-core", "@earendil-works/pi-telemetry", "@earendil-works/pi-tui", "@earendil-works/chord"], grok_version: "1.0.30", grok_platforms: { "linux-x64": { package_name: "@xai-official/grok-linux-x64", binary_name: "grok", sha256: "504dd6546ab991b75d36698242875ce461489cd1f8cd84285873cb55bd5c7d54" }, "win32-x64": { package_name: "@xai-official/grok-win32-x64", binary_name: "grok.exe", sha256: "48736d1a4342a801ea26d0ecde4c516b653f791399065adaa55973f83abd8867" } } };
+    agent_cli_release_default = { package_name: "@vtxmacro/cli", package_version: "2026.10.60", codex_package_name: "@openai/codex", codex_version: "0.155.0", copilot_sdk_package_name: "@github/copilot-sdk", copilot_sdk_version: "1.0.0-beta.8", copilot_cli_package_name: "@github/copilot", copilot_cli_version: "1.0.80", deepseek_harness_version: "0.1.1-rc.2", deepseek_harness_packages: ["@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-agent-loop", "@deepseek-ai/dsh-agent-spine-demo", "@deepseek-ai/dsh-anonymous-user-id", "@deepseek-ai/dsh-atomic-write", "@deepseek-ai/dsh-attachment", "@deepseek-ai/dsh-brand", "@deepseek-ai/dsh-code-runtime", "@deepseek-ai/dsh-credentials", "@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-goal", "@deepseek-ai/dsh-goal-round-driver", "@deepseek-ai/dsh-home-paths", "@deepseek-ai/dsh-invariants", "@deepseek-ai/dsh-jobs", "@deepseek-ai/dsh-jobs-local", "@deepseek-ai/dsh-launch-environment", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-llm-deepseek", "@deepseek-ai/dsh-llm-retry", "@deepseek-ai/dsh-output-retention", "@deepseek-ai/dsh-sandbox", "@deepseek-ai/dsh-sandbox-policy", "@deepseek-ai/dsh-scope", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-session-checkpoint-policy", "@deepseek-ai/dsh-session-persistence", "@deepseek-ai/dsh-session-persistence-jsonl", "@deepseek-ai/dsh-session-projection", "@deepseek-ai/dsh-session-title", "@deepseek-ai/dsh-settings", "@deepseek-ai/dsh-shell", "@deepseek-ai/dsh-shell-env", "@deepseek-ai/dsh-skill", "@deepseek-ai/dsh-skill-filesystem", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt", "@deepseek-ai/dsh-timeout", "@deepseek-ai/dsh-tool-bash", "@deepseek-ai/dsh-tool-goal", "@deepseek-ai/dsh-tool-jobs", "@deepseek-ai/dsh-tool-skill", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-user-approval"], deepseek_cordis_package_name: "@deepseek-ai/cordis", deepseek_cordis_version: "4.0.1", deepseek_support_packages: { "@deepseek-ai/cordis-plugin-timer": "1.1.3" }, platforms: { "linux-x64": { package_name: "@openai/codex-linux-x64", target: "x86_64-unknown-linux-musl", binary_name: "codex", sha256: "660e159a49e823ac8e5986cb238f73158ce4b957d40d9292f8de90862644b501" }, "win32-x64": { package_name: "@openai/codex-win32-x64", target: "x86_64-pc-windows-msvc", binary_name: "codex.exe", sha256: "e4c11374bd9de8ad5c3b7617fd4654bb7839901edb0863f9930666863c7a021b" } }, pi_coding_agent_package_name: "@earendil-works/pi-coding-agent", pi_ai_package_name: "@earendil-works/pi-ai", pi_version: "0.85.1", pi_support_packages: ["@earendil-works/pi-agent-core", "@earendil-works/pi-telemetry", "@earendil-works/pi-tui", "@earendil-works/chord"], grok_version: "1.0.30", grok_platforms: { "linux-x64": { package_name: "@xai-official/grok-linux-x64", binary_name: "grok", sha256: "504dd6546ab991b75d36698242875ce461489cd1f8cd84285873cb55bd5c7d54" }, "win32-x64": { package_name: "@xai-official/grok-win32-x64", binary_name: "grok.exe", sha256: "48736d1a4342a801ea26d0ecde4c516b653f791399065adaa55973f83abd8867" } } };
   }
 });
 
@@ -3151,6 +3151,19 @@ var runtime_policy_generated_default = {
     error_details: {
       review_failure_message_max_length: 220
     }
+  },
+  llm: {
+    provider_diagnostics: {
+      reply_body_max_chars: 65536,
+      reply_max_headers: 64,
+      reply_header_name_parts: [
+        "retry-after",
+        "ratelimit",
+        "rate-limit",
+        "quota",
+        "balance"
+      ]
+    }
   }
 };
 

package/bin/vtx-service-bootstrap.js

@@ -14,7 +14,7 @@ import { dirname as dirname4, relative as relative4, resolve as resolve4 } from
 import { fileURLToPath } from "node:url";
 
 // agent-cli-release.json
-var agent_cli_release_default = { package_name: "@vtxmacro/cli", package_version: "2026.10.59", codex_package_name: "@openai/codex", codex_version: "0.155.0", copilot_sdk_package_name: "@github/copilot-sdk", copilot_sdk_version: "1.0.0-beta.8", copilot_cli_package_name: "@github/copilot", copilot_cli_version: "1.0.80", deepseek_harness_version: "0.1.1-rc.2", deepseek_harness_packages: ["@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-agent-loop", "@deepseek-ai/dsh-agent-spine-demo", "@deepseek-ai/dsh-anonymous-user-id", "@deepseek-ai/dsh-atomic-write", "@deepseek-ai/dsh-attachment", "@deepseek-ai/dsh-brand", "@deepseek-ai/dsh-code-runtime", "@deepseek-ai/dsh-credentials", "@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-goal", "@deepseek-ai/dsh-goal-round-driver", "@deepseek-ai/dsh-home-paths", "@deepseek-ai/dsh-invariants", "@deepseek-ai/dsh-jobs", "@deepseek-ai/dsh-jobs-local", "@deepseek-ai/dsh-launch-environment", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-llm-deepseek", "@deepseek-ai/dsh-llm-retry", "@deepseek-ai/dsh-output-retention", "@deepseek-ai/dsh-sandbox", "@deepseek-ai/dsh-sandbox-policy", "@deepseek-ai/dsh-scope", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-session-checkpoint-policy", "@deepseek-ai/dsh-session-persistence", "@deepseek-ai/dsh-session-persistence-jsonl", "@deepseek-ai/dsh-session-projection", "@deepseek-ai/dsh-session-title", "@deepseek-ai/dsh-settings", "@deepseek-ai/dsh-shell", "@deepseek-ai/dsh-shell-env", "@deepseek-ai/dsh-skill", "@deepseek-ai/dsh-skill-filesystem", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt", "@deepseek-ai/dsh-timeout", "@deepseek-ai/dsh-tool-bash", "@deepseek-ai/dsh-tool-goal", "@deepseek-ai/dsh-tool-jobs", "@deepseek-ai/dsh-tool-skill", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-user-approval"], deepseek_cordis_package_name: "@deepseek-ai/cordis", deepseek_cordis_version: "4.0.1", deepseek_support_packages: { "@deepseek-ai/cordis-plugin-timer": "1.1.3" }, platforms: { "linux-x64": { package_name: "@openai/codex-linux-x64", target: "x86_64-unknown-linux-musl", binary_name: "codex", sha256: "660e159a49e823ac8e5986cb238f73158ce4b957d40d9292f8de90862644b501" }, "win32-x64": { package_name: "@openai/codex-win32-x64", target: "x86_64-pc-windows-msvc", binary_name: "codex.exe", sha256: "e4c11374bd9de8ad5c3b7617fd4654bb7839901edb0863f9930666863c7a021b" } }, pi_coding_agent_package_name: "@earendil-works/pi-coding-agent", pi_ai_package_name: "@earendil-works/pi-ai", pi_version: "0.85.1", pi_support_packages: ["@earendil-works/pi-agent-core", "@earendil-works/pi-telemetry", "@earendil-works/pi-tui", "@earendil-works/chord"], grok_version: "1.0.30", grok_platforms: { "linux-x64": { package_name: "@xai-official/grok-linux-x64", binary_name: "grok", sha256: "504dd6546ab991b75d36698242875ce461489cd1f8cd84285873cb55bd5c7d54" }, "win32-x64": { package_name: "@xai-official/grok-win32-x64", binary_name: "grok.exe", sha256: "48736d1a4342a801ea26d0ecde4c516b653f791399065adaa55973f83abd8867" } } };
+var agent_cli_release_default = { package_name: "@vtxmacro/cli", package_version: "2026.10.60", codex_package_name: "@openai/codex", codex_version: "0.155.0", copilot_sdk_package_name: "@github/copilot-sdk", copilot_sdk_version: "1.0.0-beta.8", copilot_cli_package_name: "@github/copilot", copilot_cli_version: "1.0.80", deepseek_harness_version: "0.1.1-rc.2", deepseek_harness_packages: ["@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-agent-loop", "@deepseek-ai/dsh-agent-spine-demo", "@deepseek-ai/dsh-anonymous-user-id", "@deepseek-ai/dsh-atomic-write", "@deepseek-ai/dsh-attachment", "@deepseek-ai/dsh-brand", "@deepseek-ai/dsh-code-runtime", "@deepseek-ai/dsh-credentials", "@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-goal", "@deepseek-ai/dsh-goal-round-driver", "@deepseek-ai/dsh-home-paths", "@deepseek-ai/dsh-invariants", "@deepseek-ai/dsh-jobs", "@deepseek-ai/dsh-jobs-local", "@deepseek-ai/dsh-launch-environment", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-llm-deepseek", "@deepseek-ai/dsh-llm-retry", "@deepseek-ai/dsh-output-retention", "@deepseek-ai/dsh-sandbox", "@deepseek-ai/dsh-sandbox-policy", "@deepseek-ai/dsh-scope", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-session-checkpoint-policy", "@deepseek-ai/dsh-session-persistence", "@deepseek-ai/dsh-session-persistence-jsonl", "@deepseek-ai/dsh-session-projection", "@deepseek-ai/dsh-session-title", "@deepseek-ai/dsh-settings", "@deepseek-ai/dsh-shell", "@deepseek-ai/dsh-shell-env", "@deepseek-ai/dsh-skill", "@deepseek-ai/dsh-skill-filesystem", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt", "@deepseek-ai/dsh-timeout", "@deepseek-ai/dsh-tool-bash", "@deepseek-ai/dsh-tool-goal", "@deepseek-ai/dsh-tool-jobs", "@deepseek-ai/dsh-tool-skill", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-user-approval"], deepseek_cordis_package_name: "@deepseek-ai/cordis", deepseek_cordis_version: "4.0.1", deepseek_support_packages: { "@deepseek-ai/cordis-plugin-timer": "1.1.3" }, platforms: { "linux-x64": { package_name: "@openai/codex-linux-x64", target: "x86_64-unknown-linux-musl", binary_name: "codex", sha256: "660e159a49e823ac8e5986cb238f73158ce4b957d40d9292f8de90862644b501" }, "win32-x64": { package_name: "@openai/codex-win32-x64", target: "x86_64-pc-windows-msvc", binary_name: "codex.exe", sha256: "e4c11374bd9de8ad5c3b7617fd4654bb7839901edb0863f9930666863c7a021b" } }, pi_coding_agent_package_name: "@earendil-works/pi-coding-agent", pi_ai_package_name: "@earendil-works/pi-ai", pi_version: "0.85.1", pi_support_packages: ["@earendil-works/pi-agent-core", "@earendil-works/pi-telemetry", "@earendil-works/pi-tui", "@earendil-works/chord"], grok_version: "1.0.30", grok_platforms: { "linux-x64": { package_name: "@xai-official/grok-linux-x64", binary_name: "grok", sha256: "504dd6546ab991b75d36698242875ce461489cd1f8cd84285873cb55bd5c7d54" }, "win32-x64": { package_name: "@xai-official/grok-win32-x64", binary_name: "grok.exe", sha256: "48736d1a4342a801ea26d0ecde4c516b653f791399065adaa55973f83abd8867" } } };
 
 // lib/runtime-policy.generated.json
 var runtime_policy_generated_default = {
@@ -1423,6 +1423,19 @@ var runtime_policy_generated_default = {
     error_details: {
       review_failure_message_max_length: 220
     }
+  },
+  llm: {
+    provider_diagnostics: {
+      reply_body_max_chars: 65536,
+      reply_max_headers: 64,
+      reply_header_name_parts: [
+        "retry-after",
+        "ratelimit",
+        "rate-limit",
+        "quota",
+        "balance"
+      ]
+    }
   }
 };
 

package/bin/vtx-service-launcher.js

@@ -1407,6 +1407,19 @@ var runtime_policy_generated_default = {
     error_details: {
       review_failure_message_max_length: 220
     }
+  },
+  llm: {
+    provider_diagnostics: {
+      reply_body_max_chars: 65536,
+      reply_max_headers: 64,
+      reply_header_name_parts: [
+        "retry-after",
+        "ratelimit",
+        "rate-limit",
+        "quota",
+        "balance"
+      ]
+    }
   }
 };
 

package/bin/vtx.js

@@ -122,7 +122,7 @@ var init_routing = __esm({
 var agent_cli_release_default;
 var init_agent_cli_release = __esm({
   "agent-cli-release.json"() {
-    agent_cli_release_default = { package_name: "@vtxmacro/cli", package_version: "2026.10.59", codex_package_name: "@openai/codex", codex_version: "0.155.0", copilot_sdk_package_name: "@github/copilot-sdk", copilot_sdk_version: "1.0.0-beta.8", copilot_cli_package_name: "@github/copilot", copilot_cli_version: "1.0.80", deepseek_harness_version: "0.1.1-rc.2", deepseek_harness_packages: ["@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-agent-loop", "@deepseek-ai/dsh-agent-spine-demo", "@deepseek-ai/dsh-anonymous-user-id", "@deepseek-ai/dsh-atomic-write", "@deepseek-ai/dsh-attachment", "@deepseek-ai/dsh-brand", "@deepseek-ai/dsh-code-runtime", "@deepseek-ai/dsh-credentials", "@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-goal", "@deepseek-ai/dsh-goal-round-driver", "@deepseek-ai/dsh-home-paths", "@deepseek-ai/dsh-invariants", "@deepseek-ai/dsh-jobs", "@deepseek-ai/dsh-jobs-local", "@deepseek-ai/dsh-launch-environment", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-llm-deepseek", "@deepseek-ai/dsh-llm-retry", "@deepseek-ai/dsh-output-retention", "@deepseek-ai/dsh-sandbox", "@deepseek-ai/dsh-sandbox-policy", "@deepseek-ai/dsh-scope", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-session-checkpoint-policy", "@deepseek-ai/dsh-session-persistence", "@deepseek-ai/dsh-session-persistence-jsonl", "@deepseek-ai/dsh-session-projection", "@deepseek-ai/dsh-session-title", "@deepseek-ai/dsh-settings", "@deepseek-ai/dsh-shell", "@deepseek-ai/dsh-shell-env", "@deepseek-ai/dsh-skill", "@deepseek-ai/dsh-skill-filesystem", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt", "@deepseek-ai/dsh-timeout", "@deepseek-ai/dsh-tool-bash", "@deepseek-ai/dsh-tool-goal", "@deepseek-ai/dsh-tool-jobs", "@deepseek-ai/dsh-tool-skill", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-user-approval"], deepseek_cordis_package_name: "@deepseek-ai/cordis", deepseek_cordis_version: "4.0.1", deepseek_support_packages: { "@deepseek-ai/cordis-plugin-timer": "1.1.3" }, platforms: { "linux-x64": { package_name: "@openai/codex-linux-x64", target: "x86_64-unknown-linux-musl", binary_name: "codex", sha256: "660e159a49e823ac8e5986cb238f73158ce4b957d40d9292f8de90862644b501" }, "win32-x64": { package_name: "@openai/codex-win32-x64", target: "x86_64-pc-windows-msvc", binary_name: "codex.exe", sha256: "e4c11374bd9de8ad5c3b7617fd4654bb7839901edb0863f9930666863c7a021b" } }, pi_coding_agent_package_name: "@earendil-works/pi-coding-agent", pi_ai_package_name: "@earendil-works/pi-ai", pi_version: "0.85.1", pi_support_packages: ["@earendil-works/pi-agent-core", "@earendil-works/pi-telemetry", "@earendil-works/pi-tui", "@earendil-works/chord"], grok_version: "1.0.30", grok_platforms: { "linux-x64": { package_name: "@xai-official/grok-linux-x64", binary_name: "grok", sha256: "504dd6546ab991b75d36698242875ce461489cd1f8cd84285873cb55bd5c7d54" }, "win32-x64": { package_name: "@xai-official/grok-win32-x64", binary_name: "grok.exe", sha256: "48736d1a4342a801ea26d0ecde4c516b653f791399065adaa55973f83abd8867" } } };
+    agent_cli_release_default = { package_name: "@vtxmacro/cli", package_version: "2026.10.60", codex_package_name: "@openai/codex", codex_version: "0.155.0", copilot_sdk_package_name: "@github/copilot-sdk", copilot_sdk_version: "1.0.0-beta.8", copilot_cli_package_name: "@github/copilot", copilot_cli_version: "1.0.80", deepseek_harness_version: "0.1.1-rc.2", deepseek_harness_packages: ["@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-agent-loop", "@deepseek-ai/dsh-agent-spine-demo", "@deepseek-ai/dsh-anonymous-user-id", "@deepseek-ai/dsh-atomic-write", "@deepseek-ai/dsh-attachment", "@deepseek-ai/dsh-brand", "@deepseek-ai/dsh-code-runtime", "@deepseek-ai/dsh-credentials", "@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-goal", "@deepseek-ai/dsh-goal-round-driver", "@deepseek-ai/dsh-home-paths", "@deepseek-ai/dsh-invariants", "@deepseek-ai/dsh-jobs", "@deepseek-ai/dsh-jobs-local", "@deepseek-ai/dsh-launch-environment", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-llm-deepseek", "@deepseek-ai/dsh-llm-retry", "@deepseek-ai/dsh-output-retention", "@deepseek-ai/dsh-sandbox", "@deepseek-ai/dsh-sandbox-policy", "@deepseek-ai/dsh-scope", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-session-checkpoint-policy", "@deepseek-ai/dsh-session-persistence", "@deepseek-ai/dsh-session-persistence-jsonl", "@deepseek-ai/dsh-session-projection", "@deepseek-ai/dsh-session-title", "@deepseek-ai/dsh-settings", "@deepseek-ai/dsh-shell", "@deepseek-ai/dsh-shell-env", "@deepseek-ai/dsh-skill", "@deepseek-ai/dsh-skill-filesystem", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt", "@deepseek-ai/dsh-timeout", "@deepseek-ai/dsh-tool-bash", "@deepseek-ai/dsh-tool-goal", "@deepseek-ai/dsh-tool-jobs", "@deepseek-ai/dsh-tool-skill", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-user-approval"], deepseek_cordis_package_name: "@deepseek-ai/cordis", deepseek_cordis_version: "4.0.1", deepseek_support_packages: { "@deepseek-ai/cordis-plugin-timer": "1.1.3" }, platforms: { "linux-x64": { package_name: "@openai/codex-linux-x64", target: "x86_64-unknown-linux-musl", binary_name: "codex", sha256: "660e159a49e823ac8e5986cb238f73158ce4b957d40d9292f8de90862644b501" }, "win32-x64": { package_name: "@openai/codex-win32-x64", target: "x86_64-pc-windows-msvc", binary_name: "codex.exe", sha256: "e4c11374bd9de8ad5c3b7617fd4654bb7839901edb0863f9930666863c7a021b" } }, pi_coding_agent_package_name: "@earendil-works/pi-coding-agent", pi_ai_package_name: "@earendil-works/pi-ai", pi_version: "0.85.1", pi_support_packages: ["@earendil-works/pi-agent-core", "@earendil-works/pi-telemetry", "@earendil-works/pi-tui", "@earendil-works/chord"], grok_version: "1.0.30", grok_platforms: { "linux-x64": { package_name: "@xai-official/grok-linux-x64", binary_name: "grok", sha256: "504dd6546ab991b75d36698242875ce461489cd1f8cd84285873cb55bd5c7d54" }, "win32-x64": { package_name: "@xai-official/grok-win32-x64", binary_name: "grok.exe", sha256: "48736d1a4342a801ea26d0ecde4c516b653f791399065adaa55973f83abd8867" } } };
   }
 });
 
@@ -1536,6 +1536,19 @@ var init_runtime_policy_generated = __esm({
         error_details: {
           review_failure_message_max_length: 220
         }
+      },
+      llm: {
+        provider_diagnostics: {
+          reply_body_max_chars: 65536,
+          reply_max_headers: 64,
+          reply_header_name_parts: [
+            "retry-after",
+            "ratelimit",
+            "rate-limit",
+            "quota",
+            "balance"
+          ]
+        }
       }
     };
   }
@@ -23194,6 +23207,19 @@ var init_runtime_policy_generated2 = __esm({
         error_details: {
           review_failure_message_max_length: 220
         }
+      },
+      llm: {
+        provider_diagnostics: {
+          reply_body_max_chars: 65536,
+          reply_max_headers: 64,
+          reply_header_name_parts: [
+            "retry-after",
+            "ratelimit",
+            "rate-limit",
+            "quota",
+            "balance"
+          ]
+        }
       }
     };
   }
@@ -26956,7 +26982,7 @@ var init_mcp_transport = __esm({
 });
 
 // lib/inference-host/mcp-client.ts
-var EXTERNAL_INFERENCE_MCP_PROTOCOL_VERSION, EXTERNAL_INFERENCE_AUTOMATED_HOST_TOOLS, EXTERNAL_INFERENCE_OPERATIONAL_TOOLS, ClaimTiming, ExternalInferenceMcpError, DEFAULT_REQUEST_TIMEOUT_MS, MAX_RETRY_AFTER_MS, SSE_DATA_FIELD_PREFIX, PUBLIC_TOOL_ERROR_PREFIX, parseRetryAfterMs, identifierSchema2, safeCodeSchema2, publicFailureCodeSchema, publicToolErrorSchema, structuredPublicToolErrorSchema, MAX_REJECTION_REASON_CHARS, CONTROL_CHARACTERS, publicRejectionReason, parsePublicToolError, hostMutationResultSchema, attemptStartResultSchema, agentConnectResultSchema, agentHeartbeatResultSchema, timestampSchema2, positiveGenerationSchema, jsonObjectSchema, agentAssignmentNextArgumentsSchema, agentDataCapabilityDescriptorSchema, agentAssignmentNextResultSchema, agentAssignmentHeartbeatArgumentsSchema, agentAssignmentHeartbeatResultSchema, agentDataCallArgumentsSchema, agentDataCallResultSchema, agentDecisionTimingSchema, agentDecisionSubmitArgumentsSchema, agentDecisionSubmitResultSchema, agentDecisionStatusArgumentsSchema, agentDecisionStatusResultSchema, agentAssignmentReleaseArgumentsSchema, agentAssignmentReleaseResultSchema, jobCompletionResultSchema, jobFailureResultSchema, toolContracts, discoveryResultSchema, toolListResultSchema, inlineStructuredContentSchema, protocolMeta, parseJsonDocument, parseSseDocuments, parseResponseDocuments, exactOperationalInventory, exactJson, invalidBoundResult, verifyToolResult, ExternalInferenceMcpClient;
+var EXTERNAL_INFERENCE_MCP_PROTOCOL_VERSION, EXTERNAL_INFERENCE_AUTOMATED_HOST_TOOLS, EXTERNAL_INFERENCE_OPERATIONAL_TOOLS, ClaimTiming, ExternalInferenceMcpError, DEFAULT_REQUEST_TIMEOUT_MS, MAX_RETRY_AFTER_MS, SSE_DATA_FIELD_PREFIX, PUBLIC_TOOL_ERROR_PREFIX, parseRetryAfterMs, identifierSchema2, safeCodeSchema2, serverReasonCodeSchema, publicFailureCodeSchema, publicToolErrorSchema, structuredPublicToolErrorSchema, MAX_REJECTION_REASON_CHARS, CONTROL_CHARACTERS, publicRejectionReason, parsePublicToolError, hostMutationResultSchema, attemptStartResultSchema, agentConnectResultSchema, agentHeartbeatResultSchema, timestampSchema2, positiveGenerationSchema, jsonObjectSchema, agentAssignmentNextArgumentsSchema, agentDataCapabilityDescriptorSchema, agentAssignmentNextResultSchema, agentAssignmentHeartbeatArgumentsSchema, agentAssignmentHeartbeatResultSchema, agentDataCallArgumentsSchema, agentDataCallResultSchema, agentDecisionTimingSchema, agentDecisionSubmitArgumentsSchema, agentDecisionSubmitResultSchema, agentDecisionStatusArgumentsSchema, agentDecisionStatusResultSchema, agentAssignmentReleaseArgumentsSchema, agentAssignmentReleaseResultSchema, jobCompletionResultSchema, jobFailureResultSchema, toolContracts, discoveryResultSchema, toolListResultSchema, inlineStructuredContentSchema, protocolMeta, parseJsonDocument, parseSseDocuments, parseResponseDocuments, exactOperationalInventory, exactJson, invalidBoundResult, verifyToolResult, ExternalInferenceMcpClient;
 var init_mcp_client = __esm({
   "lib/inference-host/mcp-client.ts"() {
     "use strict";
@@ -27108,6 +27134,7 @@ var init_mcp_client = __esm({
         this.httpStatusCode = options.httpStatusCode ?? null;
         this.retryAfterMs = options.retryAfterMs ?? null;
         this.serverFailureCode = options.serverFailureCode ?? null;
+        this.serverReasonCode = options.serverReasonCode ?? null;
         this.retryable = options.retryable ?? [
           "network_error",
           "transport_rejected",
@@ -27133,6 +27160,7 @@ var init_mcp_client = __esm({
     };
     identifierSchema2 = external_exports.string().min(1).max(EXTERNAL_INFERENCE_SCHEMA_BOUNDS.identifier_length);
     safeCodeSchema2 = external_exports.string().min(1).max(EXTERNAL_INFERENCE_SCHEMA_BOUNDS.long_code_length);
+    serverReasonCodeSchema = safeCodeSchema2.regex(/^[a-z0-9][a-z0-9._-]*$/u);
     publicFailureCodeSchema = external_exports.string().regex(/^[a-z0-9][a-z0-9._-]{0,95}$/u);
     publicToolErrorSchema = external_exports.object({
       failure_code: publicFailureCodeSchema,
@@ -27964,6 +27992,7 @@ var init_mcp_client = __esm({
                 // the exact request unless the server proves it was not applied.
                 retryable: retryableInfrastructureRejection || retryableClaimRejection || retryableHeartbeatClockSkew || retryableAdvertisementClockSkew,
                 serverFailureCode: publicToolError?.failure_code ?? null,
+                serverReasonCode: serverReasonCodeSchema.safeParse(publicToolError?.reason_code).data ?? null,
                 retryAfterMs: hostNotClaimable ? publicToolError?.retry_after_ms ?? null : null
               }
             );
@@ -34703,7 +34732,7 @@ async function logoutCodexSubscription(options) {
     await session.close();
   }
 }
-var CODEX_INFERENCE_PERMISSION_PROFILE, CODEX_AGENT_PERMISSION_PROFILE, CODEX_REASONING_CONTENT_MAX_UTF8_BYTES, CODEX_REASONING_SUMMARY_MAX_UTF8_BYTES, utf8Prefix, reasoningContentPrefix, HOST_RUNTIME_POLICY, CODEX_ACCOUNT_PLAN_TYPES, CODEX_AGENT_DYNAMIC_TOOLS, CodexAppServerError, objectOrNull, finiteToken, tokenUsageFromBreakdown, usageFromNotification, validPlanType, nonnegativeSafeIntegerOrNull, nonnegativeFiniteNumberOrNull, parseRateLimitWindow, RATE_LIMIT_REACHED_TYPES, DEFAULT_CODEX_QUOTA_COOLDOWN_MS, MAX_CODEX_QUOTA_COOLDOWN_MS, CODEX_TRANSIENT_RATE_LIMIT_COOLDOWN_MS, parseCreditsSnapshot, codexCreditsAvailable, parseRateLimitSnapshot, codexRateLimitRetryAtMs, codexAccountRateLimitReached, forbiddenMethod, forbiddenTerminalItem, forbiddenAgentMethod, forbiddenAgentTerminalItem, createCodexAgentToolSpecs, classifyCodexTurnFailure, scrubbedCodexEnvironment, killWindowsProcessTree, appServerArgs, GUARDIAN_SCRIPT, WINDOWS_RECEIPT_REPLACE_ERROR_CODES, MAX_RETIRED_RESPONSE_IDS, LATE_RESPONSE_SAFE_METHODS, replaceCodexGuardianReceiptFile, writeCodexGuardianSpawnIntent, parseGuardianReceipt, readCodexGuardianReceipt, waitForCodexGuardianState, defaultSpawn, CodexAppServerSession;
+var CODEX_INFERENCE_PERMISSION_PROFILE, CODEX_AGENT_PERMISSION_PROFILE, CODEX_REASONING_CONTENT_MAX_UTF8_BYTES, CODEX_REASONING_SUMMARY_MAX_UTF8_BYTES, utf8Prefix, reasoningContentPrefix, HOST_RUNTIME_POLICY, CODEX_ACCOUNT_PLAN_TYPES, CODEX_AGENT_DYNAMIC_TOOLS, CodexAppServerError, objectOrNull, finiteToken, tokenUsageFromBreakdown, usageFromNotification, validPlanType, nonnegativeSafeIntegerOrNull, nonnegativeFiniteNumberOrNull, parseRateLimitWindow, RATE_LIMIT_REACHED_TYPES, DEFAULT_CODEX_QUOTA_COOLDOWN_MS, MAX_CODEX_QUOTA_COOLDOWN_MS, CODEX_TRANSIENT_RATE_LIMIT_COOLDOWN_MS, parseCreditsSnapshot, parseCodexAccountRateLimits, codexCreditsAvailable, parseRateLimitSnapshot, codexRateLimitRetryAtMs, codexAccountRateLimitReached, forbiddenMethod, forbiddenTerminalItem, forbiddenAgentMethod, forbiddenAgentTerminalItem, createCodexAgentToolSpecs, classifyCodexTurnFailure, scrubbedCodexEnvironment, killWindowsProcessTree, appServerArgs, GUARDIAN_SCRIPT, WINDOWS_RECEIPT_REPLACE_ERROR_CODES, MAX_RETIRED_RESPONSE_IDS, LATE_RESPONSE_SAFE_METHODS, replaceCodexGuardianReceiptFile, writeCodexGuardianSpawnIntent, parseGuardianReceipt, readCodexGuardianReceipt, waitForCodexGuardianState, defaultSpawn, CodexAppServerSession;
 var init_codex_app_server = __esm({
   "lib/inference-host/codex-app-server.ts"() {
     "use strict";
@@ -34843,6 +34872,23 @@ var init_codex_app_server = __esm({
         balance: candidate.balance ?? null
       };
     };
+    parseCodexAccountRateLimits = (value) => {
+      const candidate = objectOrNull(value);
+      if (!candidate) throw new Error("invalid account rate limits");
+      const rateLimits = parseRateLimitSnapshot(candidate.rateLimits);
+      const rawByLimitId = candidate.rateLimitsByLimitId;
+      let rateLimitsByLimitId = null;
+      if (rawByLimitId !== null && rawByLimitId !== void 0) {
+        const byLimitId = objectOrNull(rawByLimitId);
+        if (!byLimitId) throw new Error("invalid rate-limit bucket map");
+        rateLimitsByLimitId = {};
+        for (const [limitId, snapshot] of Object.entries(byLimitId)) {
+          if (!limitId.trim()) throw new Error("invalid rate-limit bucket identity");
+          rateLimitsByLimitId[limitId] = parseRateLimitSnapshot(snapshot);
+        }
+      }
+      return { rateLimits, rateLimitsByLimitId };
+    };
     codexCreditsAvailable = (snapshot) => {
       const credits = parseCreditsSnapshot(snapshot.credits);
       return credits !== null && (credits.hasCredits || credits.unlimited);
@@ -35976,19 +36022,7 @@ child.once('close', async (code, signal) => {
           signal
         });
         try {
-          const rateLimits = parseRateLimitSnapshot(result.rateLimits);
-          const rawByLimitId = result.rateLimitsByLimitId;
-          let rateLimitsByLimitId = null;
-          if (rawByLimitId !== null && rawByLimitId !== void 0) {
-            const byLimitId = objectOrNull(rawByLimitId);
-            if (!byLimitId) throw new Error("invalid rate-limit bucket map");
-            rateLimitsByLimitId = {};
-            for (const [limitId, snapshot] of Object.entries(byLimitId)) {
-              if (!limitId.trim()) throw new Error("invalid rate-limit bucket identity");
-              rateLimitsByLimitId[limitId] = parseRateLimitSnapshot(snapshot);
-            }
-          }
-          return { rateLimits, rateLimitsByLimitId };
+          return parseCodexAccountRateLimits(result);
         } catch (error48) {
           throw new CodexAppServerError({
             message: "Codex returned invalid account rate-limit metadata.",
@@ -37809,6 +37843,67 @@ var init_attempt_failure = __esm({
   }
 });
 
+// lib/inference-host/claim-answer.ts
+var claimDeferral, quotaRecoveryMayLiftRefusal, createClaimDeferralLog, recordClaimFailure;
+var init_claim_answer = __esm({
+  "lib/inference-host/claim-answer.ts"() {
+    "use strict";
+    init_define_VTX_CLAUDE_CODE_POLICY();
+    init_define_VTX_EXO_POLICY();
+    init_define_VTX_GROK_POLICY();
+    init_define_VTX_PI_MODEL_POLICY();
+    init_mcp_client();
+    claimDeferral = (error48, staleReplay) => {
+      if (!(error48 instanceof ExternalInferenceMcpError)) return null;
+      if (error48.serverFailureCode === "host_not_claimable" && error48.retryable) {
+        return { reason: error48.serverReasonCode ?? error48.serverFailureCode, retry_after_ms: error48.retryAfterMs };
+      }
+      if (error48.definitivelyNotApplied && staleReplay && error48.code === "tool_rejected") {
+        return { reason: error48.serverReasonCode ?? error48.serverFailureCode ?? error48.code, retry_after_ms: null };
+      }
+      return null;
+    };
+    quotaRecoveryMayLiftRefusal = (error48) => !(error48 instanceof ExternalInferenceMcpError && error48.serverReasonCode === "provider_cooldown_fixed");
+    createClaimDeferralLog = () => {
+      const last = /* @__PURE__ */ new Map();
+      return {
+        changed: (deferral) => {
+          if (last.has(deferral.reason) && last.get(deferral.reason) === deferral.retry_after_ms) return false;
+          last.set(deferral.reason, deferral.retry_after_ms);
+          return true;
+        },
+        /** A claim the server served (or found nothing for) ends every deferral. */
+        reset: () => {
+          last.clear();
+        }
+      };
+    };
+    recordClaimFailure = (claimFailures, failure2) => {
+      const open4 = claimFailures.find((record6) => record6.resolution === void 0 && record6.claim_request_id === failure2.claimRequestId);
+      const responseBodyBytes = failure2.timing?.response_body_bytes ?? null;
+      const bodyCut = failure2.failureCode === "network_error" && (responseBodyBytes ?? 0) > 0;
+      if (open4) {
+        open4.attempts = Math.min(Number.MAX_SAFE_INTEGER, open4.attempts + 1);
+        if (bodyCut) open4.body_cut = true;
+        if (responseBodyBytes !== null) {
+          open4.response_body_bytes = Math.max(open4.response_body_bytes ?? 0, responseBodyBytes);
+        }
+        return false;
+      }
+      claimFailures.push({
+        claim_request_id: failure2.claimRequestId,
+        failed_at: failure2.failedAt,
+        failure_code: failure2.failureCode,
+        http_status_code: failure2.httpStatusCode,
+        response_body_bytes: responseBodyBytes,
+        body_cut: bodyCut,
+        attempts: 1
+      });
+      return true;
+    };
+  }
+});
+
 // lib/inference-host/runner.ts
 import { createHash as createHash5, randomUUID as randomUUID2 } from "node:crypto";
 function createDefaultInferenceHostRunnerDependencies(options) {
@@ -37868,6 +37963,7 @@ var init_runner = __esm({
     init_config2();
     init_oauth();
     init_attempt_failure();
+    init_claim_answer();
     canReplayFencedAgentTerminal = (state2, fence) => state2?.schema_version === "vtx_inference_agent_runtime_v3" && state2.adapter_id === fence.adapter_id && state2.host_id === fence.host_id && state2.assignment.assignment_id === fence.assignment_id && state2.pending_turn?.terminal_receipt?.terminal_status === "failed" && state2.pending_turn.terminal_receipt.failure_code === fence.failure_code && (fence.dispatch_outcome !== "outcome_unknown" || (state2.pending_turn.terminal_receipt.grok_tool_validation?.prior_dispatch === true || state2.pending_turn.terminal_receipt.grok_response_identity != null || state2.pending_turn.terminal_receipt.provider_http_status !== void 0) && state2.pending_turn.terminal_receipt.dispatch_outcome === "outcome_unknown");
     fencedTurnAwaitsAssignmentCheck = (state2, fence) => fence.failure_code === "agent_turn_outcome_unknown" && state2?.schema_version === "vtx_inference_agent_runtime_v3" && state2.adapter_id === fence.adapter_id && state2.host_id === fence.host_id && state2.assignment.assignment_id === fence.assignment_id && state2.pending_turn != null && !state2.pending_turn.terminal_receipt;
     RUNTIME_RECEIPT_SCHEMA_VERSION = "vtx_inference_host_runtime_v1";
@@ -38555,6 +38651,7 @@ var init_runner = __esm({
         let terminalRecoveryFailureCode = null;
         let acknowledgedRecoveryDiagnostic = null;
         const claimFailures = [];
+        const claimDeferralLog = createClaimDeferralLog();
         let claimFailuresDropped = 0;
         const boundClaimFailures = () => {
           while (claimFailures.length > EXTERNAL_INFERENCE_LIMITS.max_heartbeat_claim_failures) {
@@ -39263,7 +39360,7 @@ var init_runner = __esm({
               );
               throw error48;
             }
-            if (claimAvailabilityBackoff !== null && result.host.status === "online" && request.provider_quota_recovery != null && Date.parse(request.provider_quota_recovery.observed_at) >= claimAvailabilityBackoff.rejectedAtMs) {
+            if (claimAvailabilityBackoff?.liftable === true && result.host.status === "online" && request.provider_quota_recovery != null && Date.parse(request.provider_quota_recovery.observed_at) >= claimAvailabilityBackoff.rejectedAtMs) {
               claimAvailabilityBackoff = null;
             }
           };
@@ -39971,6 +40068,7 @@ var init_runner = __esm({
                   }
                 );
                 assertClaimResult(request, claim);
+                claimDeferralLog.reset();
                 resolveClaimFailures(
                   "replayed",
                   (record6) => record6.claim_request_id === request.claim_request_id
@@ -39981,35 +40079,25 @@ var init_runner = __esm({
                   "claim_failed"
                 );
                 const httpStatusCode = error48 instanceof ExternalInferenceMcpError ? error48.httpStatusCode : null;
-                if (claimTiming) emitDiagnostic("claim_request_failed", {
-                  claim_request_id: request.claim_request_id,
-                  failure_code: failureCode,
-                  http_status_code: httpStatusCode,
-                  client_timing: claimTiming
-                });
-                if (!this.options.signal?.aborted) {
-                  const open4 = claimFailures.find((record6) => record6.resolution === void 0 && record6.claim_request_id === request.claim_request_id);
-                  const responseBodyBytes = claimTiming?.response_body_bytes ?? null;
-                  const bodyCut = failureCode === "network_error" && (responseBodyBytes ?? 0) > 0;
-                  if (open4) {
-                    open4.attempts = Math.min(Number.MAX_SAFE_INTEGER, open4.attempts + 1);
-                    if (bodyCut) open4.body_cut = true;
-                    if (responseBodyBytes !== null) {
-                      open4.response_body_bytes = Math.max(open4.response_body_bytes ?? 0, responseBodyBytes);
-                    }
-                  } else {
-                    claimFailures.push({
-                      claim_request_id: request.claim_request_id,
-                      failed_at: isoAt(claimCallStartedAtMs),
-                      failure_code: failureCode,
-                      http_status_code: httpStatusCode,
-                      response_body_bytes: responseBodyBytes,
-                      body_cut: bodyCut,
-                      attempts: 1
-                    });
-                    boundClaimFailures();
-                  }
+                const deferral = claimDeferral(error48, request.advertisement_generation < receipt.advertisement_generation);
+                if (deferral && claimDeferralLog.changed(deferral)) {
+                  emitDiagnostic("claim_deferred", { claim_request_id: request.claim_request_id, ...deferral });
+                } else if (!deferral && claimTiming) {
+                  emitDiagnostic("claim_request_failed", {
+                    claim_request_id: request.claim_request_id,
+                    failure_code: failureCode,
+                    http_status_code: httpStatusCode,
+                    server_failure_code: error48 instanceof ExternalInferenceMcpError ? error48.serverFailureCode : null,
+                    client_timing: claimTiming
+                  });
                 }
+                if (!deferral && !this.options.signal?.aborted && recordClaimFailure(claimFailures, {
+                  claimRequestId: request.claim_request_id,
+                  failedAt: isoAt(claimCallStartedAtMs),
+                  failureCode,
+                  httpStatusCode,
+                  timing: claimTiming
+                })) boundClaimFailures();
                 if (!this.options.signal?.aborted && request.schema_version === "external_inference_job_claim_v4" && error48 instanceof ExternalInferenceMcpError && error48.serverFailureCode === "schema_validation") {
                   batchClaimVersion = INFERENCE_JOB_CLAIM_SCHEMA_VERSION.V3;
                   await mutateReceipt((current) => ({
@@ -40101,7 +40189,7 @@ var init_runner = __esm({
                   const rejectedAtMs = now();
                   const retryAtMs = rejectedAtMs + remoteRetryAfterMs(error48, HOST_RUNTIME_POLICY2.remote_retry_fallback_ms);
                   if (error48 instanceof ExternalInferenceMcpError && error48.serverFailureCode === "host_not_claimable") {
-                    claimAvailabilityBackoff = { untilMs: retryAtMs, rejectedAtMs };
+                    claimAvailabilityBackoff = { untilMs: retryAtMs, rejectedAtMs, liftable: quotaRecoveryMayLiftRefusal(error48) };
                   } else {
                     nextClaimAt = retryAtMs;
                   }
@@ -42777,7 +42865,7 @@ import {
 import { createHash as createHash7, randomBytes as randomBytes4 } from "node:crypto";
 import { tmpdir as tmpdir3 } from "node:os";
 import { isAbsolute as isAbsolute6, join as join6, relative as relative4, resolve as resolve5, sep as sep3 } from "node:path";
-var MAX_PROMPT_BYTES2, HOST_RUNTIME_POLICY4, CODEX_MODEL_NAME_PATTERN, CODEX_REASONING_EFFORT_PATTERN, codexRecoveryCheckpointProcessFingerprint, proveCodexSameBootQuiescence, tokenUsageReceiptSchema, turnResultReceiptSchema, terminalReceiptSchema, recoveryCheckpointSchema, recoveryFileSchema, FileCodexAttemptRecoveryStore, utf8Bytes, assertAttemptActive, tomlString, permissionConfig, ensureDedicatedCodexHome, createIsolatedCodexAttemptResources, isMissingPathError, createIsolatedCodexHostResources, validateAttemptInput, isStrictDescendant, assertRecoveryResourceScope, removeRecoveredThread, confirmCodexGuardianTerminated, confirmGuardianTerminatedForRecovery, recoveredCodexProcessExit, reconcileCodexAttemptRecovery, CodexSubscriptionAdapter, CodexAgentSubscriptionAdapter;
+var MAX_PROMPT_BYTES2, HOST_RUNTIME_POLICY4, CODEX_MODEL_NAME_PATTERN, CODEX_REASONING_EFFORT_PATTERN, codexRecoveryCheckpointProcessFingerprint, proveCodexSameBootQuiescence, tokenUsageReceiptSchema, turnResultReceiptSchema, terminalReceiptSchema, recoveryAccountLimitsSchema, recoveryCheckpointSchema, recoveryFileSchema, FileCodexAttemptRecoveryStore, utf8Bytes, assertAttemptActive, tomlString, permissionConfig, ensureDedicatedCodexHome, createIsolatedCodexAttemptResources, isMissingPathError, createIsolatedCodexHostResources, validateAttemptInput, isStrictDescendant, assertRecoveryResourceScope, removeRecoveredThread, confirmCodexGuardianTerminated, confirmGuardianTerminatedForRecovery, recoveredCodexProcessExit, reconcileCodexAttemptRecovery, CodexSubscriptionAdapter, CodexAgentSubscriptionAdapter;
 var init_codex_adapter = __esm({
   "lib/inference-host/codex-adapter.ts"() {
     "use strict";
@@ -42870,6 +42958,23 @@ var init_codex_adapter = __esm({
         })
       })
     ]);
+    recoveryAccountLimitsSchema = external_exports.strictObject({
+      schema_version: external_exports.literal("vtx_codex_recovery_account_limits_v1"),
+      attempts: external_exports.record(external_exports.string(), external_exports.strictObject({
+        // The exact failure the limits were read with: input, code and retry time.
+        inputSha256: external_exports.string().regex(/^[0-9a-f]{64}$/u),
+        code: external_exports.string().min(1).max(CODEX_RECOVERY_RECEIPT_MAX_CHARS.ERROR_CODE),
+        retryAtMs: external_exports.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).nullable(),
+        rateLimits: external_exports.custom((value) => {
+          try {
+            parseCodexAccountRateLimits(value);
+            return true;
+          } catch {
+            return false;
+          }
+        })
+      }))
+    });
     recoveryCheckpointSchema = external_exports.strictObject({
       schemaVersion: external_exports.literal("vtx_codex_attempt_recovery_v1"),
       attemptId: identifierSchema,
@@ -42907,6 +43012,10 @@ var init_codex_adapter = __esm({
         this.path = path;
         this.queue = Promise.resolve();
       }
+      /** The account limits file beside the recovery file (recoveryAccountLimitsSchema). */
+      get accountLimitsPath() {
+        return `${this.path}.account-limits.json`;
+      }
       async readAll() {
         const raw = await readInferencePrivateFile(this.path, "Codex attempt recovery file");
         if (raw === null) return {};
@@ -42924,44 +43033,116 @@ var init_codex_adapter = __esm({
         }
         return document2.attempts;
       }
+      async readAccountLimits() {
+        try {
+          const raw = await readInferencePrivateFile(this.accountLimitsPath, "Codex recovery account limits file");
+          return raw === null ? {} : recoveryAccountLimitsSchema.parse(JSON.parse(raw)).attempts;
+        } catch {
+          return {};
+        }
+      }
+      // Limits reach only the exact failure they were read with.
+      withAccountLimits(checkpoint, limits) {
+        const entry = limits[checkpoint.attemptId];
+        const terminal = checkpoint.terminal;
+        if (terminal?.kind !== "failed" || entry?.inputSha256 !== checkpoint.inputSha256 || entry.code !== terminal.error.code || entry.retryAtMs !== (terminal.error.retryAtMs ?? null)) return checkpoint;
+        return { ...checkpoint, terminal: { kind: "failed", error: { ...terminal.error, rateLimits: entry.rateLimits } } };
+      }
+      // The limits file is written first (a crash between the writes leaves limits
+      // no failure matches, never a failure missing them) and only when its entries
+      // change, and never at the recovery file's expense: a limits file that cannot
+      // be written costs only the limits. Entries of attempts the recovery file no
+      // longer holds (cleared by this or an older release) go.
+      async writeAll(attempts, limits, previous) {
+        const kept = Object.fromEntries(Object.entries(limits).filter(([attemptId]) => attemptId in attempts));
+        if (Object.keys(attempts).length === 0 || JSON.stringify(kept) !== JSON.stringify(previous)) {
+          try {
+            if (Object.keys(kept).length === 0) {
+              await clearInferencePrivateFile(this.accountLimitsPath, "Codex recovery account limits file");
+            } else {
+              await writeAtomicInferencePrivateFile(this.accountLimitsPath, `${JSON.stringify({
+                schema_version: "vtx_codex_recovery_account_limits_v1",
+                attempts: kept
+              }, null, JSON_INDENT_SPACES)}
+`);
+            }
+          } catch {
+          }
+        }
+        if (Object.keys(attempts).length === 0) {
+          await clearInferencePrivateFile(this.path, "Codex attempt recovery file");
+          return;
+        }
+        await writeAtomicInferencePrivateFile(this.path, `${JSON.stringify({
+          schema_version: "vtx_codex_recovery_file_v1",
+          attempts
+        }, null, JSON_INDENT_SPACES)}
+`);
+      }
       enqueue(operation) {
         const pending3 = this.queue.then(operation, operation);
         this.queue = pending3.then(() => void 0, () => void 0);
         return pending3;
       }
+      /** One attempt for its same-attempt recovery, with the account limits its failure was read with. */
       async load(attemptId) {
         await this.queue;
-        return (await this.readAll())[attemptId] ?? null;
+        const checkpoint = (await this.readAll())[attemptId];
+        return checkpoint ? this.withAccountLimits(checkpoint, await this.readAccountLimits()) : null;
       }
+      /**
+       * Every attempt exactly as the recovery file holds it, without account
+       * limits: the service recovery compares these with a raw copy of the file.
+       */
       async loadAll() {
         await this.queue;
         return await this.readAll();
       }
+      /**
+       * A failure's own rateLimits (or null) replaces its stored limits; a
+       * checkpoint saved without that field (one loadAll returned) keeps them.
+       */
       async save(checkpoint) {
-        const validated = recoveryCheckpointSchema.parse(checkpoint);
+        const terminal = checkpoint.terminal;
+        let stored = checkpoint;
+        let limitsUpdate = null;
+        if (terminal?.kind === "failed" && "rateLimits" in terminal.error) {
+          const { rateLimits, ...error48 } = terminal.error;
+          limitsUpdate = { rateLimits: rateLimits ?? null };
+          stored = { ...checkpoint, terminal: { kind: "failed", error: error48 } };
+        }
+        const validated = recoveryCheckpointSchema.parse(stored);
         await this.enqueue(async () => {
           const attempts = await this.readAll();
           attempts[validated.attemptId] = validated;
-          await writeAtomicInferencePrivateFile(this.path, `${JSON.stringify({
-            schema_version: "vtx_codex_recovery_file_v1",
-            attempts
-          }, null, JSON_INDENT_SPACES)}
-`);
+          const previous = await this.readAccountLimits();
+          const limits = { ...previous };
+          if (limitsUpdate?.rateLimits && validated.terminal?.kind === "failed") {
+            limits[validated.attemptId] = {
+              inputSha256: validated.inputSha256,
+              code: validated.terminal.error.code,
+              retryAtMs: validated.terminal.error.retryAtMs ?? null,
+              rateLimits: limitsUpdate.rateLimits
+            };
+          } else if (limitsUpdate) {
+            delete limits[validated.attemptId];
+          }
+          await this.writeAll(attempts, limits, previous);
         });
       }
       async clear(attemptId) {
         await this.enqueue(async () => {
           const attempts = await this.readAll();
           delete attempts[attemptId];
-          if (Object.keys(attempts).length === 0) {
-            await clearInferencePrivateFile(this.path, "Codex attempt recovery file");
-            return;
-          }
-          await writeAtomicInferencePrivateFile(this.path, `${JSON.stringify({
-            schema_version: "vtx_codex_recovery_file_v1",
-            attempts
-          }, null, JSON_INDENT_SPACES)}
-`);
+          const previous = await this.readAccountLimits();
+          await this.writeAll(attempts, previous, previous);
+        });
+      }
+      /** Removes the recovery file and its account limits (logout and revoke). */
+      async discard() {
+        await this.enqueue(async () => {
+          await clearInferencePrivateFile(this.accountLimitsPath, "Codex recovery account limits file").catch(() => void 0);
+          await clearInferencePrivateFile(this.path, "Codex attempt recovery file");
         });
       }
     };
@@ -43946,7 +44127,8 @@ var init_codex_adapter = __esm({
               httpStatusCode: recovered.httpStatusCode,
               retryAtMs: recovered.retryAtMs,
               usage: recovered.usage,
-              processExit: recovered.processExit
+              processExit: recovered.processExit,
+              rateLimits: recovered.rateLimits ?? null
             });
           }
           throw new CodexAppServerError({
@@ -44107,7 +44289,8 @@ var init_codex_adapter = __esm({
                     httpStatusCode: error48.httpStatusCode,
                     retryAtMs: error48.retryAtMs,
                     usage: error48.usage,
-                    processExit: error48.processExit
+                    processExit: error48.processExit,
+                    rateLimits: error48.rateLimits
                   }
                 }
               };
@@ -44124,6 +44307,7 @@ var init_codex_adapter = __esm({
               retryAtMs: error48.retryAtMs,
               usage: error48.usage,
               processExit: error48.processExit,
+              rateLimits: error48.rateLimits,
               cause: error48
             });
           }
@@ -52092,9 +52276,9 @@ ${result.stderr}`)) {
         }
       }
       async status(confirmedRuntime) {
-        const manifest = await readInferenceHostServiceManifest(this.manifestPath());
+        const manifest = await readManifestAcrossAtomicReplacement(this.manifestPath());
         const runtime = confirmedRuntime?.manifest_generation === manifest?.generation ? confirmedRuntime : await readRuntimeAcrossAtomicReplacement(this.runtimePath()).catch(() => null);
-        const desired = await readInferenceHostServiceDesired(this.desiredPath());
+        const desired = await readDesiredAcrossAtomicReplacement(this.desiredPath());
         const result = await this.managerCommand("status");
         const output3 = result.stdout.trim();
         const managerActive = result.exitCode === 0 && (this.platform === "linux" ? /(?:^|\n)ActiveState=active(?:\n|$)/u.test(output3) : this.platform === "win32" ? output3.trim() === "4" : /\bstate\s*=\s*running\b/iu.test(output3));
@@ -53417,10 +53601,7 @@ Durable service:
         "Inference host runtime receipt file"
       );
       await rm17(codexGuardianReceiptRoot(config2), { recursive: true, force: true });
-      await clearInferencePrivateFile(
-        codexRecoveryPath(config2),
-        "Codex attempt recovery file"
-      );
+      await new FileCodexAttemptRecoveryStore(codexRecoveryPath(config2)).discard();
       await clearInferenceAgentAttemptState(config2.statePath);
       await clearInferenceAgentNextState(config2.statePath);
       await clearInferenceForegroundAgentControlState(config2.statePath);
@@ -63408,7 +63589,7 @@ var init_runtime_handoff = __esm({
 });
 
 // lib/runtime/provider-observability.ts
-var MAX_DIAGNOSTIC_LIST_ITEMS, record5, ERROR_TOKEN, ERROR_DOMAIN, ERROR_INPUT, ERROR_ECHO_REDACTIONS, ERROR_PROSE_REDACTIONS, CONTROL_CHARACTER_RUN, WHITESPACE_RUN, collapseProse, settled, REDACTED_MARKER_START, boundedMessage, normalizeProviderError, identifier, count4, normalizeProviderDiagnostics, providerRequestId, hash2, googleCredentialDiagnostics, withExecutionMode, retryAfterDiagnostics, extractProviderDiagnostics, estimateRequestInputTokens;
+var MAX_DIAGNOSTIC_LIST_ITEMS, record5, ERROR_TOKEN, ERROR_DOMAIN, ERROR_INPUT, ERROR_ECHO_REDACTIONS, ERROR_PROSE_REDACTIONS, CONTROL_CHARACTER_RUN, UNSTORABLE_TEXT, WHITESPACE_RUN, collapseProse, settled, REDACTED_MARKER_START, cutOutsideMarker, boundedMessage, normalizeProviderError, REPLY_POLICY, REPLY_HEADER_NAME, isProviderReplyHeaderName, boundedReplyText, normalizeProviderReply, identifier, count4, normalizeProviderDiagnostics, providerRequestId, hash2, googleCredentialDiagnostics, withExecutionMode, retryAfterDiagnostics, extractProviderDiagnostics, estimateRequestInputTokens;
 var init_provider_observability = __esm({
   "lib/runtime/provider-observability.ts"() {
     "use strict";
@@ -63418,6 +63599,7 @@ var init_provider_observability = __esm({
     init_define_VTX_PI_MODEL_POLICY();
     init_constants();
     init_runtime_redaction();
+    init_runtime_policy_generated2();
     MAX_DIAGNOSTIC_LIST_ITEMS = PROVIDER_DIAGNOSTIC_LIMITS.MAX_LIST_ITEMS;
     record5 = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
     ERROR_TOKEN = /^[A-Z][A-Z0-9_]{0,63}$/;
@@ -63438,6 +63620,7 @@ var init_provider_observability = __esm({
       [/"[^"]*"|'[^'\r\n]*'/g, "[REDACTED]"]
     ];
     CONTROL_CHARACTER_RUN = /[\x00-\x1f\x7f]+/g;
+    UNSTORABLE_TEXT = /\u0000|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
     WHITESPACE_RUN = new RegExp(`${WHITESPACE_CLASS}+`, "g");
     collapseProse = (value) => value.replace(CONTROL_CHARACTER_RUN, " ").replace(WHITESPACE_RUN, " ").trim();
     settled = (value) => {
@@ -63451,12 +63634,14 @@ var init_provider_observability = __esm({
       return current;
     };
     REDACTED_MARKER_START = "[REDACTED";
+    cutOutsideMarker = (full, cut) => {
+      const opened = cut.lastIndexOf("[");
+      return opened !== -1 && full.startsWith(REDACTED_MARKER_START, opened) && full.indexOf("]", opened) >= cut.length ? cut.slice(0, opened) : cut;
+    };
     boundedMessage = (value) => {
       const characters = Array.from(value);
       if (characters.length <= PROVIDER_DIAGNOSTIC_LIMITS.MAX_ERROR_MESSAGE_CHARS) return value;
-      let cut = characters.slice(0, PROVIDER_DIAGNOSTIC_LIMITS.MAX_ERROR_MESSAGE_CHARS).join("");
-      const marker2 = cut.lastIndexOf(REDACTED_MARKER_START);
-      if (marker2 !== -1 && value.indexOf("]", marker2) >= cut.length) cut = cut.slice(0, marker2);
+      const cut = cutOutsideMarker(value, characters.slice(0, PROVIDER_DIAGNOSTIC_LIMITS.MAX_ERROR_MESSAGE_CHARS).join(""));
       return cut.replace(/ +$/, "");
     };
     normalizeProviderError = (value) => {
@@ -63473,6 +63658,7 @@ var init_provider_observability = __esm({
           message = sanitizeRuntimeDiagnosticValue(message);
           for (const [pattern, replacement] of ERROR_PROSE_REDACTIONS) message = message.replace(pattern, replacement);
           message = settled(sanitizeRuntimeDiagnosticValue(collapseProse(sanitizeRuntimeDiagnosticValue(message))));
+          message = message.replace(UNSTORABLE_TEXT, "\uFFFD");
         }
         const fullLength = Array.from(message).length;
         let bounded = boundedMessage(message);
@@ -63492,6 +63678,35 @@ var init_provider_observability = __esm({
       }
       return result;
     };
+    REPLY_POLICY = runtime_policy_generated_default2.llm.provider_diagnostics;
+    REPLY_HEADER_NAME = /^[a-z0-9][a-z0-9-]{0,127}$/;
+    isProviderReplyHeaderName = (name) => {
+      const lowered = name.toLowerCase();
+      return REPLY_HEADER_NAME.test(lowered) && REPLY_POLICY.reply_header_name_parts.some((part) => lowered.includes(part));
+    };
+    boundedReplyText = (value) => {
+      const masked = sanitizeRuntimeDiagnosticValue(value.replace(UNSTORABLE_TEXT, "\uFFFD"));
+      const characters = Array.from(masked);
+      if (characters.length <= REPLY_POLICY.reply_body_max_chars) return { text: masked, truncated: false };
+      let cut = cutOutsideMarker(masked, characters.slice(0, REPLY_POLICY.reply_body_max_chars).join(""));
+      while (sanitizeRuntimeDiagnosticValue(cut) !== cut) cut = Array.from(cut).slice(0, -1).join("");
+      return { text: cut, truncated: true };
+    };
+    normalizeProviderReply = (value) => {
+      const raw = record5(value);
+      const result = {};
+      if (typeof raw.status === "number" && Number.isInteger(raw.status) && raw.status >= HTTP_STATUS_MIN && raw.status <= HTTP_STATUS_MAX) result.status = raw.status;
+      if (typeof raw.body === "string" && raw.body) {
+        const { text: text2, truncated } = boundedReplyText(raw.body);
+        if (text2) {
+          result.body = text2;
+          if (truncated || raw.body_truncated === true) result.body_truncated = true;
+        }
+      }
+      const headers = Object.entries(record5(raw.headers)).filter((entry) => typeof entry[1] === "string" && entry[0] === entry[0].toLowerCase() && isProviderReplyHeaderName(entry[0])).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).slice(0, REPLY_POLICY.reply_max_headers);
+      if (headers.length) result.headers = Object.fromEntries(headers.map(([name, text2]) => [name, boundedReplyText(text2).text]));
+      return result;
+    };
     identifier = (v) => typeof v === "string" && /^[A-Za-z0-9][A-Za-z0-9_.:/-]{0,255}$/.test(v) ? v : void 0;
     count4 = (v) => {
       if (typeof v !== "number" && (typeof v !== "string" || !v.trim())) return void 0;
@@ -63531,6 +63746,8 @@ var init_provider_observability = __esm({
         }).filter((v) => Object.keys(v).length > 0);
         if (violations.length) result.quota_violations = violations;
       }
+      const providerReply = normalizeProviderReply(raw.provider_reply);
+      if (Object.keys(providerReply).length) result.provider_reply = providerReply;
       const outputValidation = record5(raw.output_validation);
       if (Array.isArray(outputValidation.expected_symbols)) {
         const symbols = outputValidation.expected_symbols.slice(0, MAX_DIAGNOSTIC_LIST_ITEMS).map(identifier).filter((symbol2) => symbol2 !== void 0);
@@ -105324,7 +105541,7 @@ var init_execution_capacity = __esm({
 });
 
 // lib/runtime/owed-protection-warnings.ts
-var storageKey, isWarning, identity2, owesProtectionRecord, distinctProtectionWarnings, owedProtectionWarnings, store, oweProtectionWarnings, forgetProtectionWarnings;
+var storageKey, configuredStorage2, owedStorage, isWarning, identity2, owesProtectionRecord, distinctProtectionWarnings, owedProtectionWarnings, store, oweProtectionWarnings, forgetProtectionWarnings;
 var init_owed_protection_warnings = __esm({
   "lib/runtime/owed-protection-warnings.ts"() {
     "use strict";
@@ -105334,6 +105551,8 @@ var init_owed_protection_warnings = __esm({
     init_define_VTX_PI_MODEL_POLICY();
     init_host_storage();
     storageKey = (profileId) => `vtx:protection-warning-outbox:${String(profileId ?? "").trim()}`;
+    configuredStorage2 = null;
+    owedStorage = () => configuredStorage2 ?? runtimeHostStorage();
     isWarning = (value) => {
       const record6 = value;
       return record6 != null && typeof record6 === "object" && typeof record6.symbol === "string" && typeof record6.action === "string" && typeof record6.status === "string" && (record6.order_id === null || typeof record6.order_id === "string") && record6.execution_metadata != null && typeof record6.execution_metadata === "object";
@@ -105351,7 +105570,7 @@ var init_owed_protection_warnings = __esm({
     };
     owedProtectionWarnings = (profileId) => {
       try {
-        const parsed = JSON.parse(runtimeHostStorage()?.getItem(storageKey(profileId)) ?? "[]");
+        const parsed = JSON.parse(owedStorage()?.getItem(storageKey(profileId)) ?? "[]");
         return Array.isArray(parsed) ? parsed.filter(isWarning) : [];
       } catch {
         return [];
@@ -105359,7 +105578,7 @@ var init_owed_protection_warnings = __esm({
     };
     store = (profileId, warnings) => {
       try {
-        const storage3 = runtimeHostStorage();
+        const storage3 = owedStorage();
         if (warnings.length > 0) storage3?.setItem(storageKey(profileId), JSON.stringify(warnings));
         else storage3?.removeItem(storageKey(profileId));
       } catch {
@@ -116672,7 +116891,7 @@ var init_browser_observability = __esm({
     init_define_VTX_GROK_POLICY();
     init_define_VTX_PI_MODEL_POLICY();
     init_runtime_policy_generated2();
-    CLIENT_SOURCE_VERSION = typeof process !== "undefined" && true && "225d5dbd2325c78cdbd3920226658732f878832b".trim() && "225d5dbd2325c78cdbd3920226658732f878832b".trim() !== "unstamped" ? "225d5dbd2325c78cdbd3920226658732f878832b".trim() : null;
+    CLIENT_SOURCE_VERSION = typeof process !== "undefined" && true && "1fbd5d0b063d9c340fde67bbac63073001dc6b56".trim() && "1fbd5d0b063d9c340fde67bbac63073001dc6b56".trim() !== "unstamped" ? "1fbd5d0b063d9c340fde67bbac63073001dc6b56".trim() : null;
     listenersInstalled = false;
     state = {
       loadedAtMs: Date.now(),
@@ -123661,6 +123880,122 @@ var init_native_provider_budget = __esm({
   }
 });
 
+// lib/runtime/provider-reply.ts
+var PROVIDER_LIMIT_HEADERS_HEADER, providerResponseSignals, replyBodies, rememberProviderReplyBody, readProviderPayload, rawProviderTextForDebug, extractProviderErrorDetail, extractProviderErrorWords, providerReplyHeaders, providerReplyDiagnostics;
+var init_provider_reply = __esm({
+  "lib/runtime/provider-reply.ts"() {
+    "use strict";
+    init_define_VTX_CLAUDE_CODE_POLICY();
+    init_define_VTX_EXO_POLICY();
+    init_define_VTX_GROK_POLICY();
+    init_define_VTX_PI_MODEL_POLICY();
+    init_native_provider_budget();
+    init_provider_credit();
+    init_runtime_redaction();
+    init_provider_observability();
+    init_constants();
+    PROVIDER_LIMIT_HEADERS_HEADER = "X-VTX-Provider-Limit-Headers";
+    providerResponseSignals = /* @__PURE__ */ new WeakMap();
+    replyBodies = /* @__PURE__ */ new WeakMap();
+    rememberProviderReplyBody = (response, body) => {
+      replyBodies.set(response, body);
+    };
+    readProviderPayload = async (response) => {
+      if (typeof response?.text === "function") {
+        const raw = await awaitProviderOperation(response.text(), providerResponseSignals.get(response));
+        if (typeof raw === "string" && raw) replyBodies.set(response, raw);
+        const normalizedRaw = typeof raw === "string" ? raw.trim() : "";
+        if (!normalizedRaw) {
+          return { payload: {}, rawText: "" };
+        }
+        try {
+          return {
+            payload: JSON.parse(normalizedRaw),
+            rawText: normalizedRaw
+          };
+        } catch {
+          return {
+            payload: {},
+            rawText: normalizedRaw
+          };
+        }
+      }
+      const payload = await awaitProviderOperation(response.json(), providerResponseSignals.get(response));
+      return {
+        payload,
+        rawText: ""
+      };
+    };
+    rawProviderTextForDebug = (payload, rawText) => {
+      if (!rawText) {
+        return null;
+      }
+      if (!payload || typeof payload === "object" && !Array.isArray(payload) && Object.keys(payload).length === 0) {
+        return rawText;
+      }
+      return null;
+    };
+    extractProviderErrorDetail = (payload, rawText) => {
+      const words7 = extractProviderErrorWords(payload, rawText);
+      const outOfCreditCode = providerOutOfCreditErrorCode(payload);
+      return outOfCreditCode && !words7.toLowerCase().includes(outOfCreditCode.toLowerCase()) ? `${words7}${words7 ? " " : ""}[${outOfCreditCode}]` : words7;
+    };
+    extractProviderErrorWords = (payload, rawText) => {
+      const errorNode = payload?.error;
+      if (typeof errorNode === "string" && errorNode.trim()) {
+        return errorNode.trim();
+      }
+      if (typeof errorNode?.message === "string" && errorNode.message.trim()) {
+        return errorNode.message.trim();
+      }
+      if (typeof errorNode?.detail === "string" && errorNode.detail.trim()) {
+        return errorNode.detail.trim();
+      }
+      if (typeof payload?.detail === "string" && payload.detail.trim()) {
+        return payload.detail.trim();
+      }
+      if (typeof payload?.message === "string" && payload.message.trim()) {
+        return payload.message.trim();
+      }
+      if (rawText) {
+        return sanitizeRuntimeDiagnosticValue(rawText).replace(/\s+/g, " ").slice(0, PROVIDER_ERROR_RAW_TEXT_MAX_CHARS);
+      }
+      return "";
+    };
+    providerReplyHeaders = (response) => {
+      const headers = {};
+      const read = response?.headers;
+      if (!read || typeof read.forEach !== "function") return headers;
+      try {
+        const relayed = JSON.parse(read.get(PROVIDER_LIMIT_HEADERS_HEADER) || "{}");
+        if (relayed && typeof relayed === "object" && !Array.isArray(relayed)) {
+          for (const [name, value] of Object.entries(relayed)) {
+            if (typeof value === "string" && isProviderReplyHeaderName(name)) headers[name.toLowerCase()] = value;
+          }
+        }
+      } catch {
+      }
+      read.forEach((value, name) => {
+        if (isProviderReplyHeaderName(name)) headers[name.toLowerCase()] = value;
+      });
+      return headers;
+    };
+    providerReplyDiagnostics = (response, body) => {
+      if (!response) return {};
+      const text2 = typeof body === "string" && body ? body : replyBodies.get(response);
+      const headers = providerReplyHeaders(response);
+      if (!text2 && !Object.keys(headers).length) return {};
+      return {
+        provider_reply: {
+          ...typeof response.status === "number" ? { status: response.status } : {},
+          ...text2 ? { body: text2 } : {},
+          ...Object.keys(headers).length ? { headers } : {}
+        }
+      };
+    };
+  }
+});
+
 // lib/screener-resource-scheduler.ts
 var STORAGE_KEY, CHANNEL_NAME, LOCK_TTL_MS, nowMs, stableHash, storage2, readStore, writeStore, prune2, buildLlmResourceKey, registerTraderProviderCallStarted, registerTraderProviderCallFinished;
 var init_screener_resource_scheduler = __esm({
@@ -123927,7 +124262,7 @@ var init_native_request_parameters = __esm({
 });
 
 // lib/runtime/provider-client.ts
-var mapOpenAiCompatibleNativeRequestPath, isRetryableProviderFailureForFallback, extractRuntimeProviderFailureStatusCode, isModelSpecificProviderFailure, emptyProviderContentError, isEmptyProviderContentFailure, emptyReplyForInternalAttempt, isEmptyProviderMessageFailure, isRetryableProviderAttemptFailure, providerRejectedRequestError, OPTIONAL_CONTRACT_PARAMETER_TOKENS, OPTIONAL_CONTRACT_REJECTION_TOKENS, OPTIONAL_CONTRACT_GRAMMAR_TOKENS, isOptionalContractParameterRejection, isTemperatureRefusal, PROVIDER_ROUTE_REFUSAL_PHRASE, isProviderRouteRefusal, OPTIONAL_CONTRACT_REQUEST_KEYS, OPTIONAL_CONTRACT_EXTRA_BODY_KEYS, resolveEmptyContentRetryPolicy, resolveStreamRetryPolicy, isKeySpecificOrTransientProviderFailure, providerDispatchClockMs, beginProviderDispatch, providerDispatchLatencyMs, attachProviderDispatchFailure, attachProviderFailureTrace, toRuntimeExecutionMode, buildNoneReasoningPayload, normalizeLevelValue, buildRuntimeReasoningPayload, resolveProviderReasoningParameters, requestedReasoningParameters, usesReasoningCompletionTokens, shouldRequestReasoningTrace, runtimeProviderForByokProvider, findByokProviderForRuntime, findModelOption, findNativeRequestParametersForModel, modelHasNativeRequestApiSurface, asRequestRecord, setDottedRequestValue, normalizeProviderMaxTokens, applyRuntimeRequestContract, normalizeProvider2, requireProviderEndpoint, SSE_DATA_FIELD_PREFIX2, estimateTokenCount, normalizeUsageCount, buildOpenAiUsagePayload, buildAnthropicUsagePayload, buildGoogleUsagePayload, normalizeProviderUsageMetrics, providerResponseSignals, fetchProvider, readProviderPayload, emitRuntimeDelta, readProviderTextStream, readProviderJsonEventStream, providerStreamError, extractOpenAiCompatibleDeltaText, readOpenAiCompatibleTextStream, rawProviderTextForDebug, extractProviderErrorDetail, extractProviderErrorWords, buildProviderFailureDiagnostic, buildCanonicalProviderFailureMessage, providerRefusal, toProviderNetworkDebugError, REASONING_ONLY_CONTENT_TYPES, extractOpenAiContentPartText, extractOpenAiReasoningPartText, extractOpenAiMessageContent, extractOpenAiMessageReasoningContent, extractOpenAiCompatibleText, normalizeRuntimeChatHistory, calculateProviderCost, resolveVeniceRequestContract, callOpenAiCompatible, extractOpenAiResponsesText, extractOpenAiResponsesReasoning, readOpenAiResponsesStream, internalDispatchAttempt, callOpenAiResponses, extractAnthropicMessageText, extractAnthropicReasoningContent, readAnthropicMessageStream, callAnthropic, isAqGoogleKey, googleKeySurfaceRef, resolveGoogleKeySurface, googlePublicModelIdRegexes, shouldUseGooglePublicEndpointForModel, normalizeGoogleModelId, shouldRetryGoogleVertexRequestPublicly, GOOGLE_VERTEX_PUBLIC_RETRY_NOTE, buildGoogleRequest, GOOGLE_JSON_MODE_REFUSAL_PHRASES, googleTradeResponseMimeType, providerRequestFailure, isGoogleJsonModeRefusal, isGoogleReasoningPart, extractGoogleMessageText, extractGoogleReasoningContent, extractGoogleSafetyMetadata, GOOGLE_BLOCKED_FINISH_REASONS, googleProviderBlockReason, readGoogleGenerateStream, callGoogle, resolveRuntimeProvider, defaultInvocationContext, defaultProviderTransport, invocationFailureCode, buildBrowserInvocation, resolveProviderSecretKey, resolveNativeProviderCredentialSlots, resolveProviderSecretKeySlots, requireOpenAiCompatibleRuntimeBaseUrl, runtimeSubscriptionPlan, runtimeKeySlotSupportsModel, invokeRuntimeProviderAttempt, invokeRuntimeProvider;
+var mapOpenAiCompatibleNativeRequestPath, isRetryableProviderFailureForFallback, extractRuntimeProviderFailureStatusCode, isModelSpecificProviderFailure, emptyProviderContentError, isEmptyProviderContentFailure, emptyReplyForInternalAttempt, isEmptyProviderMessageFailure, isRetryableProviderAttemptFailure, providerRejectedRequestError, OPTIONAL_CONTRACT_PARAMETER_TOKENS, OPTIONAL_CONTRACT_REJECTION_TOKENS, OPTIONAL_CONTRACT_GRAMMAR_TOKENS, isOptionalContractParameterRejection, isTemperatureRefusal, PROVIDER_ROUTE_REFUSAL_PHRASE, isProviderRouteRefusal, OPTIONAL_CONTRACT_REQUEST_KEYS, OPTIONAL_CONTRACT_EXTRA_BODY_KEYS, resolveEmptyContentRetryPolicy, resolveStreamRetryPolicy, isKeySpecificOrTransientProviderFailure, providerDispatchClockMs, beginProviderDispatch, providerDispatchLatencyMs, attachProviderDispatchFailure, attachProviderFailureTrace, toRuntimeExecutionMode, buildNoneReasoningPayload, normalizeLevelValue, buildRuntimeReasoningPayload, resolveProviderReasoningParameters, requestedReasoningParameters, usesReasoningCompletionTokens, shouldRequestReasoningTrace, runtimeProviderForByokProvider, findByokProviderForRuntime, findModelOption, findNativeRequestParametersForModel, modelHasNativeRequestApiSurface, asRequestRecord, setDottedRequestValue, normalizeProviderMaxTokens, applyRuntimeRequestContract, normalizeProvider2, requireProviderEndpoint, SSE_DATA_FIELD_PREFIX2, estimateTokenCount, normalizeUsageCount, buildOpenAiUsagePayload, buildAnthropicUsagePayload, buildGoogleUsagePayload, normalizeProviderUsageMetrics, fetchProvider, emitRuntimeDelta, readProviderTextStream, readProviderJsonEventStream, providerStreamError, extractOpenAiCompatibleDeltaText, readOpenAiCompatibleTextStream, buildProviderFailureDiagnostic, buildCanonicalProviderFailureMessage, providerRefusal, toProviderNetworkDebugError, REASONING_ONLY_CONTENT_TYPES, extractOpenAiContentPartText, extractOpenAiReasoningPartText, extractOpenAiMessageContent, extractOpenAiMessageReasoningContent, extractOpenAiCompatibleText, normalizeRuntimeChatHistory, calculateProviderCost, resolveVeniceRequestContract, callOpenAiCompatible, extractOpenAiResponsesText, extractOpenAiResponsesReasoning, readOpenAiResponsesStream, internalDispatchAttempt, callOpenAiResponses, extractAnthropicMessageText, extractAnthropicReasoningContent, readAnthropicMessageStream, callAnthropic, isAqGoogleKey, googleKeySurfaceRef, resolveGoogleKeySurface, googlePublicModelIdRegexes, shouldUseGooglePublicEndpointForModel, normalizeGoogleModelId, shouldRetryGoogleVertexRequestPublicly, GOOGLE_VERTEX_PUBLIC_RETRY_NOTE, buildGoogleRequest, GOOGLE_JSON_MODE_REFUSAL_PHRASES, googleTradeResponseMimeType, providerRequestFailure, isGoogleJsonModeRefusal, isGoogleReasoningPart, extractGoogleMessageText, extractGoogleReasoningContent, extractGoogleSafetyMetadata, GOOGLE_BLOCKED_FINISH_REASONS, googleProviderBlockReason, readGoogleGenerateStream, callGoogle, resolveRuntimeProvider, defaultInvocationContext, defaultProviderTransport, invocationFailureCode, buildBrowserInvocation, resolveProviderSecretKey, resolveNativeProviderCredentialSlots, resolveProviderSecretKeySlots, requireOpenAiCompatibleRuntimeBaseUrl, runtimeSubscriptionPlan, runtimeKeySlotSupportsModel, invokeRuntimeProviderAttempt, invokeRuntimeProvider;
 var init_provider_client = __esm({
   "lib/runtime/provider-client.ts"() {
     "use strict";
@@ -123938,6 +124273,7 @@ var init_provider_client = __esm({
     init_google_egress();
     init_native_provider_budget();
     init_retired_model_source();
+    init_provider_reply();
     init_provider_observability();
     init_api2();
     init_network_debug();
@@ -124085,7 +124421,8 @@ var init_provider_client = __esm({
       sanitizedError.runtimeProviderRequestId = providerRequestId(response);
       sanitizedError.runtimeProviderDiagnostics = {
         ...marker2?.providerDiagnostics ?? {},
-        ...error48 instanceof NativeModelTimeoutError && error48.attemptCapExpired ? { timeout_bound: "attempt_cap" } : {}
+        ...error48 instanceof NativeModelTimeoutError && error48.attemptCapExpired ? { timeout_bound: "attempt_cap" } : {},
+        ...providerReplyDiagnostics(response, error48?.runtimeProviderReplyBody)
       };
       sanitizedError.runtimeRetryAfterSeconds = retryAfterDiagnostics(response).retry_after_seconds ?? null;
       if (marker2?.googleQuotaFailure) sanitizedError.runtimeGoogleQuotaFailure = true;
@@ -124570,38 +124907,12 @@ var init_provider_client = __esm({
       completionTokens: usage.completionTokens,
       totalTokens: usage.totalTokens
     });
-    providerResponseSignals = /* @__PURE__ */ new WeakMap();
     fetchProvider = async (url2, init2) => {
       if (init2.signal?.aborted) throw init2.signal.reason ?? new DOMException("Cancelled", "AbortError");
       const response = await awaitProviderOperation(startLongRequest(() => fetch(url2, init2)), init2.signal);
       if (init2.signal) providerResponseSignals.set(response, init2.signal);
       return response;
     };
-    readProviderPayload = async (response) => {
-      if (typeof response?.text === "function") {
-        const raw = await awaitProviderOperation(response.text(), providerResponseSignals.get(response));
-        const normalizedRaw = typeof raw === "string" ? raw.trim() : "";
-        if (!normalizedRaw) {
-          return { payload: {}, rawText: "" };
-        }
-        try {
-          return {
-            payload: JSON.parse(normalizedRaw),
-            rawText: normalizedRaw
-          };
-        } catch {
-          return {
-            payload: {},
-            rawText: normalizedRaw
-          };
-        }
-      }
-      const payload = await awaitProviderOperation(response.json(), providerResponseSignals.get(response));
-      return {
-        payload,
-        rawText: ""
-      };
-    };
     emitRuntimeDelta = (onDelta, value) => {
       if (typeof onDelta !== "function" || typeof value !== "string" || !value) {
         return;
@@ -124655,10 +124966,10 @@ var init_provider_client = __esm({
       }
       onData(payload);
     });
-    providerStreamError = (payload, fallback) => {
+    providerStreamError = (payload, fallback, event = payload) => {
       const detail = extractProviderErrorDetail(payload, "") || fallback;
       const diagnostic = sanitizeRuntimeDiagnosticValue(`Provider request failed: ${detail}`);
-      return providerRejectedRequestError(diagnostic, detail, diagnostic);
+      return Object.assign(providerRejectedRequestError(diagnostic, detail, diagnostic), { runtimeProviderReplyBody: JSON.stringify(event) });
     };
     extractOpenAiCompatibleDeltaText = (payload) => {
       const choice = Array.isArray(payload?.choices) ? payload.choices[0] : null;
@@ -124707,6 +125018,7 @@ var init_provider_client = __esm({
         } catch {
           return;
         }
+        if (payload?.error) rememberProviderReplyBody(response, dataText);
         onPayload?.(payload);
         lastPayload = payload;
         if (typeof payload?.model === "string") {
@@ -124760,42 +125072,6 @@ var init_provider_client = __esm({
         }
       };
     };
-    rawProviderTextForDebug = (payload, rawText) => {
-      if (!rawText) {
-        return null;
-      }
-      if (!payload || typeof payload === "object" && !Array.isArray(payload) && Object.keys(payload).length === 0) {
-        return rawText;
-      }
-      return null;
-    };
-    extractProviderErrorDetail = (payload, rawText) => {
-      const words7 = extractProviderErrorWords(payload, rawText);
-      const outOfCreditCode = providerOutOfCreditErrorCode(payload);
-      return outOfCreditCode && !words7.toLowerCase().includes(outOfCreditCode.toLowerCase()) ? `${words7}${words7 ? " " : ""}[${outOfCreditCode}]` : words7;
-    };
-    extractProviderErrorWords = (payload, rawText) => {
-      const errorNode = payload?.error;
-      if (typeof errorNode === "string" && errorNode.trim()) {
-        return errorNode.trim();
-      }
-      if (typeof errorNode?.message === "string" && errorNode.message.trim()) {
-        return errorNode.message.trim();
-      }
-      if (typeof errorNode?.detail === "string" && errorNode.detail.trim()) {
-        return errorNode.detail.trim();
-      }
-      if (typeof payload?.detail === "string" && payload.detail.trim()) {
-        return payload.detail.trim();
-      }
-      if (typeof payload?.message === "string" && payload.message.trim()) {
-        return payload.message.trim();
-      }
-      if (rawText) {
-        return sanitizeRuntimeDiagnosticValue(rawText).replace(/\s+/g, " ").slice(0, PROVIDER_ERROR_RAW_TEXT_MAX_CHARS);
-      }
-      return "";
-    };
     buildProviderFailureDiagnostic = ({ response, detail }) => {
       const statusLabel = response.status ? ` (HTTP ${response.status}${response.statusText ? ` ${response.statusText}` : ""})` : "";
       return sanitizeRuntimeDiagnosticValue(
@@ -125382,9 +125658,9 @@ var init_provider_client = __esm({
         } else if (type === "response.completed" || type === "response.incomplete") {
           completed = event.response ?? null;
         } else if (type === "response.failed") {
-          failure2 ??= providerStreamError(event.response, "OpenAI Responses stream failed");
+          failure2 ??= providerStreamError(event.response, "OpenAI Responses stream failed", event);
         } else if (type === "error") {
-          failure2 ??= providerStreamError({ error: event }, "OpenAI Responses stream failed");
+          failure2 ??= providerStreamError({ error: event }, "OpenAI Responses stream failed", event);
         }
       });
       if (failure2) throw failure2;
@@ -125397,7 +125673,7 @@ var init_provider_client = __esm({
       latencyMs: providerDispatchLatencyMs(marker2),
       transport,
       requestInputTokens: marker2.requestInputTokens,
-      providerDiagnostics: marker2.providerDiagnostics,
+      providerDiagnostics: { ...marker2.providerDiagnostics, ...providerReplyDiagnostics(response) },
       providerRequestId: providerRequestId(response),
       errorDetail: getSanitizedRuntimeErrorMessage(error48) || "Provider compatibility dispatch failed.",
       // An empty reply is an unknown outcome with no status.
@@ -126032,7 +126308,7 @@ var init_provider_client = __esm({
             latencyMs: providerDispatchLatencyMs(marker2),
             transport: "google_generate_content_rest",
             requestInputTokens: marker2.requestInputTokens,
-            providerDiagnostics: { ...credentialDiagnostics, ...await extractProviderDiagnostics(payloadJson, answered) },
+            providerDiagnostics: { ...credentialDiagnostics, ...await extractProviderDiagnostics(payloadJson, answered), ...providerReplyDiagnostics(answered) },
             providerRequestId: providerRequestId(answered),
             errorDetail,
             statusCode: answered.status,
@@ -129477,9 +129753,9 @@ var init_local_analysis = __esm({
     RUNTIME_SOURCE_DEFINITION_VERSION = "runtime-source-v1";
     DECISION_INPUT_DEFINITION_VERSION = "decision-input-v1";
     CONTEXT_ENVELOPE_DEFINITION_VERSION = "context-envelope-v2.1";
-    CLIENT_RUNTIME_SOURCE_VERSION = typeof process !== "undefined" && true && "225d5dbd2325c78cdbd3920226658732f878832b".trim() && !["unknown", "unstamped", "development"].includes(
-      "225d5dbd2325c78cdbd3920226658732f878832b".trim().toLowerCase()
-    ) ? "225d5dbd2325c78cdbd3920226658732f878832b".trim() : null;
+    CLIENT_RUNTIME_SOURCE_VERSION = typeof process !== "undefined" && true && "1fbd5d0b063d9c340fde67bbac63073001dc6b56".trim() && !["unknown", "unstamped", "development"].includes(
+      "1fbd5d0b063d9c340fde67bbac63073001dc6b56".trim().toLowerCase()
+    ) ? "1fbd5d0b063d9c340fde67bbac63073001dc6b56".trim() : null;
     CLIENT_MAIN_PROMPT_RENDERER = "client_runtime.buildLocalRuntimePromptArtifacts:v1";
     CLIENT_REVIEW_PROMPT_RENDERER = "client_runtime.review_prompt_assembly:v1";
     resolveEffectivePromptRuntimeProvenance = (input) => ({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtxmacro/cli",
-  "version": "2026.10.59",
+  "version": "2026.10.60",
   "description": "VTX Macro CLI, MCP server, and durable external inference host.",
   "type": "module",
   "license": "UNLICENSED",