@wardby/cli 0.6.0 → 0.7.0

package/dist/mcp/transport/streamable-http.js

@@ -11,9 +11,18 @@ import { handleHostUserCallback } from "../host-events/github-user-callback.js";
 import { canonicalUrl, HTTP_LIMITS, HttpBoundaryError, parseBody, readBody } from "./http-limits.js";
 import { browserHandler } from "../auth/self-hosted/browser.js";
 import { handleSecretElicitationForm, SECRET_ELICITATION_PATH } from "../tools/secret-elicitation-form.js";
+import { handleRunTranscriptDownload, RUN_TRANSCRIPT_DOWNLOAD_PATH } from "../tools/run-transcript-download.js";
 import { logger } from "../../core/logger.js";
 import { VIEWER_API_PREFIX } from "../../viewer/http.js";
 const httpLog = logger.child({ module: "streamable-http" });
+/**
+ * close() waits this long for open requests to finish, then cuts them. A
+ * connected MCP client's event stream never ends on its own, so without a
+ * limit close() would hold shutdown until the pod is killed. On Kubernetes
+ * the load balancer has already moved traffic away by then (preStop), and
+ * clients reconnect to another instance.
+ */
+export const CLOSE_GRACE_MS = 10_000;
 export function sendJson(res, status, body, headers = {}) {
     res
         .writeHead(status, { "content-type": "application/json", "cache-control": "no-store", ...headers })
@@ -35,7 +44,11 @@ export async function startHttpServer(opts) {
     ]);
     const validateHost = hostHeaderValidation([canonical.hostname]);
     const nodeHandler = toNodeHandler(createMcpHandler(opts.mcp.factory, { responseMode: opts.config.responseMode }));
+    // Requests still being answered, so a close that has to cut them can say which they were.
+    const open = new Map();
     const server = createServer({ maxHeaderSize: 16 * 1024, requireHostHeader: false }, (req, res) => {
+        open.set(res, { method: req.method ?? "", path: (req.url ?? "").split("?")[0], startedAt: Date.now() });
+        res.once("close", () => open.delete(res));
         void route(req, res).catch((err) => {
             if (res.headersSent) {
                 res.destroy();
@@ -114,6 +127,17 @@ export async function startHttpServer(opts) {
             });
             return;
         }
+        if (url.pathname === RUN_TRANSCRIPT_DOWNLOAD_PATH) {
+            // The signed link is the credential (no Authorization header); the
+            // token is never logged (open-request tracking keeps the path only).
+            await handleRunTranscriptDownload(req.method, url.searchParams.get("t"), res, {
+                verify: (token) => opts.mcp.verifyRequestState(token),
+                audience: "http",
+                db: opts.auth.db,
+                blobs: opts.blobs,
+            });
+            return;
+        }
         if (oauth && (await oauth(req, res, url, body)))
             return;
         const webhook = /^\/webhooks\/([^/]+)$/.exec(url.pathname);
@@ -203,7 +227,23 @@ export async function startHttpServer(opts) {
         port: typeof address === "object" && address ? address.port : opts.config.httpBind.port,
         close: () => new Promise((resolve, reject) => {
             opts.viewer?.closeStreams();
-            server.close((err) => (err ? reject(err) : resolve()));
+            const cut = setTimeout(() => {
+                const now = Date.now();
+                const requests = [...open.values()].map((r) => ({
+                    method: r.method,
+                    path: r.path,
+                    openSeconds: Math.round((now - r.startedAt) / 1000),
+                }));
+                httpLog.info({ requests }, "HTTP connections still open after the close grace; closing them");
+                server.closeAllConnections();
+            }, opts.closeGraceMs ?? CLOSE_GRACE_MS);
+            server.close((err) => {
+                clearTimeout(cut);
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
             server.closeIdleConnections();
         }),
     };

package/dist/native-worker/docker-launcher.d.ts

@@ -6,9 +6,45 @@
  * twice, and a restarted server re-finds a running worker by name.
  */
 import { type NativeWorkerLimits } from "./docker-isolation.js";
-import type { DetachedWorkerLauncher, WorkerHandle } from "./launch.js";
+import type { DetachedWorkerLauncher, WorkerHandle, WorkerLaunchOptions } from "./launch.js";
 import type { WorkerInput } from "./protocol.js";
 import { type WarmWorkerLauncher } from "./warm-pool.js";
+/**
+ * Bounded, so a noisy worker cannot flood the log. The worker holds no long-lived credentials (only
+ * its run's gateway capability), and it redacts the secret values it received (every `secrets.get`
+ * result, and the capability) from everything it writes to stderr, its failure line and logger lines
+ * included (stderr-redaction.ts), with the console bridge's redactor and its minimum length. The
+ * worker is untrusted, so the launcher masks the tail again itself (workerTailFields).
+ */
+export declare const WORKER_STDERR_TAIL_CHARS = 2000;
+/** How long a failed worker's diagnostic (its log read and its secret values read) may take in all. */
+export declare const WORKER_TAIL_TIMEOUT_MS = 10000;
+/**
+ * Log fields for a failed worker's output. `stderrTailOmitted` says why there is no tail although
+ * there may be output: its secret values could not be read (so it could not be redacted), or its
+ * log could not be read (Kubernetes).
+ */
+export interface WorkerTailFields {
+    stderrTail?: string;
+    stderrTailOmitted?: "secrets_unavailable" | "log_read_failed";
+}
+/** `promise`, or a rejection once `ms` pass first. */
+export declare function withTimeout<T>(promise: Promise<T>, ms: number): Promise<T>;
+/**
+ * A failed worker's output tail as log fields: `stderrTail`, masked by exact value through the
+ * shared redactor against every secret value delivered to that worker (its gateway capability,
+ * from its input, and each value its tools may read, from `secretValues`, with their JSON-escaped
+ * forms). When those values are not given, cannot be read, or are not read within `timeoutMs`, no
+ * tail: `stderrTailOmitted: "secrets_unavailable"` (fail closed). No fields when the output is empty.
+ *
+ * `cut`: `output` is a slice of a longer output (a log read bounded by lines or bytes), so it may
+ * begin (`start`) or end (`end`) inside a value, which no exact match finds; as many characters as
+ * the longest value less one are masked at each cut end too.
+ */
+export declare function workerTailFields(output: string, input: WorkerInput, secretValues: (() => Promise<readonly string[]>) | undefined, cut?: {
+    start?: boolean;
+    end?: boolean;
+}, timeoutMs?: number): Promise<WorkerTailFields>;
 export interface DockerResult {
     code: number | null;
     stdout: string;
@@ -44,7 +80,7 @@ export declare class DockerNativeWorkerLauncher implements DetachedWorkerLaunche
     private must;
     /** The image must be present and pinned; a digest is pulled once, a local id must already exist. */
     private ensureImage;
-    launch(input: WorkerInput): Promise<WorkerHandle>;
+    launch(input: WorkerInput, launchOptions?: WorkerLaunchOptions): Promise<WorkerHandle>;
     /** Waits for (and reports) the worker's exit; usable after a server restart. */
     handle(runId: string): WorkerHandle;
     private handleByName;

package/dist/native-worker/docker-launcher.js

@@ -8,10 +8,65 @@
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { logger } from "../core/logger.js";
+import { maskSpans, mergeSpans, secretSpans, withEscapedForms } from "../core/secret-spans.js";
 import { buildGatewayConnectArgs, buildGatewayDisconnectArgs, buildNativeNetworkCreateArgs, buildNativeWarmNetworkCreateArgs, buildNativeWarmWorkerRunArgs, buildNativeWorkerRunArgs, gatewayConnectArgs, gatewayDisconnectArgs, nativeIsolationNames, nativeWarmIsolationNames, NATIVE_WARM_LABEL_FILTER, NATIVE_WARM_TOKEN_LABEL, NATIVE_WORKER_LABEL_FILTER, } from "./docker-isolation.js";
 import { warmDeliveryCommand } from "./warm-delivery.js";
 import { NATIVE_SANDBOX_WARM_DELIVERY_FAILED } from "./warm-pool.js";
 const launcherLog = logger.child({ module: "native-docker-launcher" });
+/**
+ * Bounded, so a noisy worker cannot flood the log. The worker holds no long-lived credentials (only
+ * its run's gateway capability), and it redacts the secret values it received (every `secrets.get`
+ * result, and the capability) from everything it writes to stderr, its failure line and logger lines
+ * included (stderr-redaction.ts), with the console bridge's redactor and its minimum length. The
+ * worker is untrusted, so the launcher masks the tail again itself (workerTailFields).
+ */
+export const WORKER_STDERR_TAIL_CHARS = 2000;
+/** How long a failed worker's diagnostic (its log read and its secret values read) may take in all. */
+export const WORKER_TAIL_TIMEOUT_MS = 10_000;
+/** `promise`, or a rejection once `ms` pass first. */
+export function withTimeout(promise, ms) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error("worker_diagnostic_timeout")), Math.max(0, ms));
+    });
+    return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+/**
+ * A failed worker's output tail as log fields: `stderrTail`, masked by exact value through the
+ * shared redactor against every secret value delivered to that worker (its gateway capability,
+ * from its input, and each value its tools may read, from `secretValues`, with their JSON-escaped
+ * forms). When those values are not given, cannot be read, or are not read within `timeoutMs`, no
+ * tail: `stderrTailOmitted: "secrets_unavailable"` (fail closed). No fields when the output is empty.
+ *
+ * `cut`: `output` is a slice of a longer output (a log read bounded by lines or bytes), so it may
+ * begin (`start`) or end (`end`) inside a value, which no exact match finds; as many characters as
+ * the longest value less one are masked at each cut end too.
+ */
+export async function workerTailFields(output, input, secretValues, cut = {}, timeoutMs = WORKER_TAIL_TIMEOUT_MS) {
+    if (!output.trim())
+        return {};
+    let delivered;
+    try {
+        if (!secretValues)
+            return { stderrTailOmitted: "secrets_unavailable" };
+        delivered = await withTimeout(secretValues(), timeoutMs);
+    }
+    catch {
+        return { stderrTailOmitted: "secrets_unavailable" };
+    }
+    const values = withEscapedForms([...(input.gateway ? [input.gateway.capability] : []), ...delivered]);
+    const spans = secretSpans(output, values);
+    const longest = Math.max(0, ...values.map((value) => value.length));
+    if (longest > 1) {
+        if (cut.start)
+            spans.push([0, Math.min(output.length, longest - 1)]);
+        if (cut.end)
+            spans.push([Math.max(0, output.length - (longest - 1)), output.length]);
+    }
+    // Masked whole, then cut: a cut can then split only a marker or plain text, never a value.
+    const stderrTail = maskSpans(output, mergeSpans(spans)).trim().slice(-WORKER_STDERR_TAIL_CHARS);
+    return stderrTail ? { stderrTail } : {};
+}
 export function processDockerCli(binary = "docker") {
     return {
         run(args, options = {}) {
@@ -20,8 +75,12 @@ export function processDockerCli(binary = "docker") {
                 let stdout = "";
                 let stderr = "";
                 const timer = options.timeoutMs ? setTimeout(() => child.kill("SIGKILL"), options.timeoutMs) : undefined;
-                child.stdout.on("data", (chunk) => (stdout += chunk.toString()));
-                child.stderr.on("data", (chunk) => (stderr += chunk.toString()));
+                // One decoder per stream, so a multi-byte character split across chunks still decodes (and a
+                // secret holding it still matches the redactor exactly).
+                child.stdout.setEncoding("utf8");
+                child.stderr.setEncoding("utf8");
+                child.stdout.on("data", (chunk) => (stdout += chunk));
+                child.stderr.on("data", (chunk) => (stderr += chunk));
                 child.on("error", (err) => resolve({ code: null, stdout, stderr: err.message }));
                 child.on("close", (code) => {
                     if (timer)
@@ -55,7 +114,7 @@ export class DockerNativeWorkerLauncher {
             return;
         await this.must(["image", "pull", "--quiet", this.options.image], "pull the worker image");
     }
-    async launch(input) {
+    async launch(input, launchOptions = {}) {
         const runId = input.runId;
         const names = nativeIsolationNames(runId);
         const existing = await this.inspect(runId);
@@ -66,9 +125,10 @@ export class DockerNativeWorkerLauncher {
             const args = buildNativeWorkerRunArgs({ runId, image: this.options.image, limits: this.options.limits });
             // Attached so the input (capability included) goes in on stdin; the exit is read with
             // `docker wait`, which a restarted server can call again.
-            void this.docker.run(args, { input: `${JSON.stringify(input)}\n` }).then((result) => {
+            void this.docker.run(args, { input: `${JSON.stringify(input)}\n` }).then(async (result) => {
                 if (result.code !== 0 && result.code !== null && !/Conflict/.test(result.stderr)) {
-                    launcherLog.warn({ container: names.worker, code: result.code }, "native worker exited non-zero");
+                    const tail = await workerTailFields(result.stderr, input, launchOptions.secretValues);
+                    launcherLog.warn({ container: names.worker, code: result.code, ...tail }, "native worker exited non-zero");
                 }
             });
         }

package/dist/native-worker/gateway-server.d.ts

@@ -10,9 +10,11 @@
  * session budget before the provider is called and settles at the provider's
  * reported usage; the worker's own usage numbers are never read.
  */
-import { type NativeRunProviders, type RunnerDb } from "../core/runner.js";
-import type { LlmStreamEvent } from "../providers/llm/types.js";
-import { PrismaGatewayLedger } from "./ledger.js";
+import { createNativeRunTools, durableDelegate, type NativeRunFinishContext, type NativeRunProviders, type RunnerDb, type SandboxSessionSnapshot } from "../core/runner.js";
+import { ReviewReadLedger } from "../core/review-reads.js";
+import type { LlmProvider, LlmStreamEvent } from "../providers/llm/types.js";
+import { PrismaGatewayLedger, type GatewaySessionRecord } from "./ledger.js";
+import { type GatewayParams } from "./protocol.js";
 /** Output tokens reserved for a model call that names no maxTokens (as the coding proxy does). */
 export declare const GATEWAY_DEFAULT_RESERVE_OUTPUT_TOKENS = 4096;
 /** The most output tokens one call may reserve for. */
@@ -37,3 +39,39 @@ export type GatewayResponse = {
 };
 /** Serves one gateway request. Never throws: every failure is a response. */
 export declare function serveGatewayRequest(deps: GatewayServerDeps, authorization: string | undefined, body: unknown): Promise<GatewayResponse>;
+/**
+ * Every secret value the rebuilt run can read (each user tool's readable or brokered values), and
+ * the request's own capability: what a cause code is checked against before it leaves the gateway.
+ */
+export declare function runSecretValues(ctx: Pick<RebuiltRun, "snapshot" | "tools">, capability: string): () => Promise<string[]>;
+/**
+ * A failure as its response. Only a checked cause code leaves the gateway (workerGatewayError),
+ * never the rest of an unexpected error's message; the server's own log line is redacted by the
+ * same values.
+ */
+export declare function failureResponse(err: unknown, secretValues: (() => Promise<string[]>) | undefined): Promise<GatewayResponse>;
+/** A model stream whose failure reaches the worker as the same checked error a JSON response carries. */
+export declare function checkedEvents(events: AsyncIterable<LlmStreamEvent>, secretValues: (() => Promise<string[]>) | undefined): AsyncIterable<LlmStreamEvent>;
+interface RebuiltRun {
+    session: GatewaySessionRecord;
+    snapshot: SandboxSessionSnapshot;
+    llm: LlmProvider;
+    tools: ReturnType<typeof createNativeRunTools>;
+    /** The run's review reads, restored from the session; saved back after each read (see builtin). */
+    reviewReads: ReviewReadLedger;
+    finishContext: NativeRunFinishContext;
+    delegation: Omit<Parameters<typeof durableDelegate>[0], "ledger" | "sessionId">;
+}
+/** Exported for its unit test; the HTTP handler is its only production caller. */
+export declare function streamModel(ctx: RebuiltRun, ledger: PrismaGatewayLedger, callId: string, params: GatewayParams<"llm.stream">): AsyncIterable<LlmStreamEvent>;
+/**
+ * Logged (at warn) in place of a user tool's console line when that tool's redaction list cannot
+ * be read: without the complete list the line cannot be shown to be free of its secret values, so
+ * none of it is logged. The tool's call still succeeds, as a console write does in-process.
+ */
+export declare const CONSOLE_WITHHELD_MESSAGE = "sandbox tool console line withheld: the tool's secret values could not be read";
+/** Serves one privileged bridge call for a worker (exported for tests). */
+export declare function hostCall(ctx: RebuiltRun, ledger: PrismaGatewayLedger, callId: string, params: GatewayParams<"host.call">): Promise<unknown>;
+/** The worker's terminal call: the run's one terminal write (masked by finishNativeRun), then the session ends. */
+export declare function finish(ctx: RebuiltRun, ledger: PrismaGatewayLedger, callId: string, params: GatewayParams<"finish">): Promise<null>;
+export {};

package/dist/native-worker/gateway-server.js

@@ -10,14 +10,15 @@
  * session budget before the provider is called and settles at the provider's
  * reported usage; the worker's own usage numbers are never read.
  */
-import { logger } from "../core/logger.js";
-import { createNativeRunTools, durableDelegate, failNativeRun, finishNativeRun, nativeRunIntegrations, recordNativeRunProgress, runDrivability, sandboxCapabilityHash, } from "../core/runner.js";
+import { createNativeRunTools, durableDelegate, failNativeRun, finishNativeRun, nativeRunIntegrations, recordNativeRunProgress, runDrivability, sandboxCapabilityHash, userToolSecretValues, } from "../core/runner.js";
+import { ReviewReadLedger } from "../core/review-reads.js";
 import { DELEGATE_TOOL_PREFIX } from "../core/tool-names.js";
+import { relayedOutputTokens } from "../providers/coding-proxy/interrupted.js";
 import { RoutingLlmProvider } from "../providers/llm/routing.js";
 import { isPrivilegedBridgeName } from "../sandbox/host-functions.js";
+import { forWorker, gatewayLog } from "./gateway.js";
 import { PrismaGatewayLedger } from "./ledger.js";
 import { GatewayError, GatewayRequestSchema, parseParams, } from "./protocol.js";
-const serverLog = logger.child({ module: "native-gateway-server" });
 /** Output tokens reserved for a model call that names no maxTokens (as the coding proxy does). */
 export const GATEWAY_DEFAULT_RESERVE_OUTPUT_TOKENS = 4_096;
 /** The most output tokens one call may reserve for. */
@@ -29,10 +30,10 @@ const ok = (result) => ({
     status: 200,
     body: { ok: true, result: result ?? null },
 });
-const fail = (status, code, message) => ({
+const fail = (status, code, message, causeCode) => ({
     kind: "json",
     status,
-    body: { ok: false, error: { code, message } },
+    body: { ok: false, error: { code, message, ...(causeCode ? { causeCode } : {}) } },
 });
 const STATUS_FOR = {
     invalid_request: 400,
@@ -46,22 +47,52 @@ const STATUS_FOR = {
 };
 /** Serves one gateway request. Never throws: every failure is a response. */
 export async function serveGatewayRequest(deps, authorization, body) {
+    // The capability once parsed, then every secret value of the rebuilt run: what a cause code and
+    // the log line are checked against. Unset (no bearer), no cause code is sent.
+    const scope = {};
     try {
-        return await handle(deps, authorization, body);
+        return await handle(deps, authorization, body, scope);
     }
     catch (err) {
-        if (err instanceof GatewayError)
-            return fail(STATUS_FOR[err.code] ?? 500, err.code, err.message);
-        serverLog.error({ err }, "native gateway request failed");
-        return fail(500, "internal", "The gateway could not serve this call.");
+        return failureResponse(err, scope.secretValues);
     }
 }
-async function handle(deps, authorization, body) {
+/**
+ * Every secret value the rebuilt run can read (each user tool's readable or brokered values), and
+ * the request's own capability: what a cause code is checked against before it leaves the gateway.
+ */
+export function runSecretValues(ctx, capability) {
+    return async () => [
+        capability,
+        ...(await userToolSecretValues(ctx.tools, Object.keys(ctx.snapshot.input.userTools))),
+    ];
+}
+/**
+ * A failure as its response. Only a checked cause code leaves the gateway (workerGatewayError),
+ * never the rest of an unexpected error's message; the server's own log line is redacted by the
+ * same values.
+ */
+export async function failureResponse(err, secretValues) {
+    const sent = await forWorker(err, secretValues, "native gateway request failed");
+    return fail(STATUS_FOR[sent.code] ?? 500, sent.code, sent.message, sent.causeCode);
+}
+/** A model stream whose failure reaches the worker as the same checked error a JSON response carries. */
+export async function* checkedEvents(events, secretValues) {
+    try {
+        yield* events;
+    }
+    catch (err) {
+        throw await forWorker(err, secretValues, "native gateway model stream failed");
+    }
+}
+async function handle(deps, authorization, body, scope) {
     const { db } = deps;
     const ledger = new PrismaGatewayLedger(db);
     const token = /^Bearer (\S+)$/.exec(authorization ?? "")?.[1];
     if (!token)
         return fail(401, "unauthorized", "A gateway capability is required.");
+    // Until the run's tools are rebuilt, the capability is the secret value an error is checked against.
+    scope.secretValues = async () => [token];
     const session = await ledger.findSessionByCapabilityHash(sandboxCapabilityHash(token));
     if (!session)
         return fail(401, "unauthorized", "Unknown gateway capability.");
@@ -90,19 +121,20 @@ async function handle(deps, authorization, body) {
         throw new GatewayError("run_not_drivable", "This run is no longer running.");
     }
     const ctx = await rebuild(deps, session);
+    scope.secretValues = runSecretValues(ctx, token);
     switch (request.method) {
         case "llm.stream":
             return {
                 kind: "stream",
                 status: 200,
-                events: streamModel(ctx, ledger, request.callId, params),
+                events: checkedEvents(streamModel(ctx, ledger, request.callId, params), scope.secretValues),
             };
         case "llm.countTokens": {
             const p = params;
             return ok(await ctx.llm.countTokens(p.model, p.messages, p.tools));
         }
         case "builtin.call":
-            return ok(await builtin(ctx, ledger, request.callId, params, deps.pollWindowMs));
+            return ok(await builtin(ctx, ledger, request.callId, params, deps.pollWindowMs, scope.secretValues));
         case "host.call":
             return ok(await hostCall(ctx, ledger, request.callId, params));
         case "progress": {
@@ -130,10 +162,12 @@ async function rebuild(deps, session) {
     const llm = loaded.pricing && providers.llm instanceof RoutingLlmProvider
         ? providers.llm.forRun(loaded.pricing.entry)
         : providers.llm;
+    const reviewReads = ReviewReadLedger.fromJSON(session.reviewReads);
     return {
         session,
         snapshot,
         llm,
+        reviewReads,
         tools: createNativeRunTools({
             runId: session.runId,
             existingRun,
@@ -143,6 +177,7 @@ async function rebuild(deps, session) {
             reviewHosts,
             repoAccess,
             issueTrackers,
+            reviewReads,
         }),
         finishContext: { runId: session.runId, db, providers, reviewHosts, repoAccess, issueTrackers },
         delegation: {
@@ -156,7 +191,8 @@ async function rebuild(deps, session) {
         },
     };
 }
-async function* streamModel(ctx, ledger, callId, params) {
+/** Exported for its unit test; the HTTP handler is its only production caller. */
+export async function* streamModel(ctx, ledger, callId, params) {
     const req = params.request;
     if (req.model !== ctx.snapshot.input.agent.model)
         throw new GatewayError("not_allowed", "A run may only call its own model.");
@@ -173,12 +209,22 @@ async function* streamModel(ctx, ledger, callId, params) {
     }
     let settled = false;
     let sawEvent = false;
+    // Set once the provider's response starts: it may bill hidden thinking or reasoning before any event.
+    let responseStarted = false;
+    // Generated output seen so far (text and tool calls), for an estimate if the stream is cut.
     let streamedText = "";
     try {
-        for await (const event of ctx.llm.stream(req)) {
+        const hooks = {
+            onResponseStarted: () => {
+                responseStarted = true;
+            },
+        };
+        for await (const event of ctx.llm.stream(req, undefined, hooks)) {
             sawEvent = true;
             if (event.type === "text")
                 streamedText += event.delta;
+            if (event.type === "tool_call")
+                streamedText += event.name + event.argsJson;
             if (event.type === "done") {
                 settled = true;
                 await ledger.complete(ctx.session.id, callId, {
@@ -194,9 +240,29 @@ async function* streamModel(ctx, ledger, callId, params) {
     }
     catch (err) {
         if (!settled) {
-            // Refused before anything streamed: the provider billed nothing. Mid-stream: unknown, keep the hold.
-            if (sawEvent)
-                await ledger.markUncertain(ctx.session.id, callId);
+            // Failed before the response started: the provider billed nothing. Once started: settle at an estimate.
+            if (sawEvent || responseStarted) {
+                // Bill the input and the output seen so far, never more than the hold. With no output seen
+                // (cut while thinking or reasoning), the run's median completed call, or none before the
+                // first one: as the coding proxy does. Estimating must never mask the stream error: on any
+                // failure, keep the full hold and rethrow the original.
+                try {
+                    const output = streamedText
+                        ? await streamedOutputTokens(ctx.llm, req.model, streamedText)
+                        : ((await ledger.medianOutputTokens(ctx.session.id)) ?? 0);
+                    const costUsd = Math.min(reservationUsd, ctx.llm.priceUsd(req.model, { inputTokens, outputTokens: output }));
+                    await ledger.markUncertain(ctx.session.id, callId, {
+                        inputTokens,
+                        outputTokens: output,
+                        cachedInputTokens: 0,
+                        cacheWriteTokens: 0,
+                        costUsd,
+                    });
+                }
+                catch {
+                    await ledger.markUncertain(ctx.session.id, callId).catch(() => undefined);
+                }
+            }
             else
                 await ledger.release(ctx.session.id, callId);
             settled = true;
@@ -206,9 +272,7 @@ async function* streamModel(ctx, ledger, callId, params) {
     finally {
         if (!settled) {
             // The worker stopped reading (its own budget cutoff) before usage arrived: bill an estimate.
-            const output = streamedText
-                ? await ctx.llm.countTokens(req.model, [{ role: "assistant", content: streamedText }]).catch(() => 0)
-                : 0;
+            const output = await streamedOutputTokens(ctx.llm, req.model, streamedText);
             await ledger.complete(ctx.session.id, callId, {
                 inputTokens,
                 outputTokens: output,
@@ -219,26 +283,58 @@ async function* streamModel(ctx, ledger, callId, params) {
         }
     }
 }
-async function builtin(ctx, ledger, callId, params, pollWindowMs) {
+/** Output tokens of a cut stream's output: counted, else the deliberately high bytes / 3 estimate. */
+async function streamedOutputTokens(llm, model, streamed) {
+    if (!streamed)
+        return 0;
+    return llm
+        .countTokens(model, [{ role: "assistant", content: streamed }])
+        .catch(() => relayedOutputTokens(Buffer.byteLength(streamed)));
+}
+/** The review tools that record reads (repo_publish_review checks them). */
+const REVIEW_READ_TOOLS = new Set(["repo_pr_read", "repo_read_file"]);
+async function builtin(ctx, ledger, callId, params, pollWindowMs, secretValues) {
     if (!ctx.snapshot.input.builtinTools.includes(params.name)) {
         throw new GatewayError("not_allowed", `"${params.name}" is not a built-in tool of this run.`);
     }
     if (params.name.startsWith(DELEGATE_TOOL_PREFIX)) {
-        const outcome = await durableDelegate({ ...ctx.delegation, pollWindowMs, ledger, sessionId: ctx.session.id }, callId, params.name, params.argsJson);
+        const outcome = await durableDelegate({ ...ctx.delegation, pollWindowMs, ledger, sessionId: ctx.session.id, secretValues }, callId, params.name, params.argsJson);
         return "pending" in outcome ? { pending: true } : outcome.result;
     }
     const handler = ctx.tools.builtinHandler(params.name);
     if (!handler)
         throw new GatewayError("not_allowed", `"${params.name}" is not a built-in tool of this run.`);
-    return replayable(ledger, ctx.session.id, callId, "builtin.call", () => handler(params.argsJson));
+    return replayable(ledger, ctx.session.id, callId, "builtin.call", async () => {
+        const result = await handler(params.argsJson);
+        // Each request rebuilds the tools, so what a read recorded is saved for the publish request's check.
+        if (REVIEW_READ_TOOLS.has(params.name))
+            await ledger.mergeReviewReads(ctx.session.id, ctx.reviewReads);
+        return result;
+    });
 }
-async function hostCall(ctx, ledger, callId, params) {
+/**
+ * Logged (at warn) in place of a user tool's console line when that tool's redaction list cannot
+ * be read: without the complete list the line cannot be shown to be free of its secret values, so
+ * none of it is logged. The tool's call still succeeds, as a console write does in-process.
+ */
+export const CONSOLE_WITHHELD_MESSAGE = "sandbox tool console line withheld: the tool's secret values could not be read";
+/** Serves one privileged bridge call for a worker (exported for tests). */
+export async function hostCall(ctx, ledger, callId, params) {
     if (!isPrivilegedBridgeName(params.bridge))
         throw new GatewayError("not_allowed", "unknown bridge");
     if (!ctx.snapshot.input.userTools[params.tool]) {
         throw new GatewayError("not_allowed", `"${params.tool}" is not a user tool of this run.`);
     }
-    const redact = params.bridge === "__bridge_console" ? await ctx.tools.readableSecretValues(params.tool) : undefined;
+    let redact;
+    if (params.bridge === "__bridge_console") {
+        // Fail closed: a console line is redacted by the tool's complete list or not logged at all.
+        const values = await ctx.tools.readableSecretValues(params.tool).then((v) => v, () => undefined);
+        if (!values) {
+            gatewayLog.warn({ tool: params.tool }, CONSOLE_WITHHELD_MESSAGE);
+            return null;
+        }
+        redact = values;
+    }
     const host = ctx.tools.privilegedHostFor(params.tool, AbortSignal.timeout(30_000), redact);
     if (!host)
         throw new GatewayError("not_allowed", `"${params.tool}" is not a user tool of this run.`);
@@ -284,7 +380,8 @@ async function replayable(ledger, sessionId, callId, method, run) {
         throw err;
     }
 }
-async function finish(ctx, ledger, callId, params) {
+/** The worker's terminal call: the run's one terminal write (masked by finishNativeRun), then the session ends. */
+export async function finish(ctx, ledger, callId, params) {
     const claimed = await ledger.claim(ctx.session.id, callId, "finish");
     if (claimed.outcome !== "claimed")
         return null;

package/dist/native-worker/gateway.d.ts

@@ -12,8 +12,29 @@
  */
 import type { EngineResult, EngineRunContext } from "../providers/engine/types.js";
 import type { LlmStreamEvent } from "../providers/llm/types.js";
+import pino from "pino";
 import { type PrivilegedHost } from "../sandbox/host-functions.js";
-import { type WorkerInput } from "./protocol.js";
+import { logger } from "../core/logger.js";
+import { GatewayError, type WorkerInput } from "./protocol.js";
+/**
+ * The gateways' log. Both (in-process and HTTP) log an unexpected error here, as `native gateway
+ * request failed` (or `native gateway model stream failed`). Exported so tests can watch it.
+ */
+export declare const gatewayLog: pino.Logger<never, boolean>;
+/**
+ * Logs an unexpected error for the operator, redacted by exact value. A successfully read list is
+ * complete (its reader rejects when any secret's read fails), so an empty one means the run has no
+ * secret values and the message is logged as is. Fail closed: a thrown value that is not an Error
+ * (a string, an object: its text cannot be redacted reliably), or no list (unavailable or
+ * unreadable), logs only the error's name and declared code, never its message, stack or content.
+ */
+export declare function logUnexpectedError(log: Pick<typeof logger, "error">, err: unknown, values: readonly string[] | undefined, logMessage: string, fields?: Record<string, unknown>): void;
+/**
+ * The one way either gateway turns a failure into what the worker sees: an unexpected error is
+ * logged for the operator (redacted by the run's secret values) and becomes the checked
+ * GatewayError (workerGatewayError); the values are read once and serve both.
+ */
+export declare function forWorker(err: unknown, secretValues: (() => Promise<Iterable<string>>) | undefined, logMessage: string): Promise<GatewayError>;
 /** The trusted gateway as a transport sees it: untrusted requests in, results or GatewayErrors out. */
 export interface NativeGateway {
     call(request: unknown): Promise<unknown>;
@@ -37,6 +58,11 @@ export interface SandboxedEngineOptions {
     ctx: Pick<EngineRunContext, "providers" | "onText" | "onProgress">;
     builtinHandler: (name: string) => ((argsJson: string) => Promise<string>) | undefined;
     privilegedHostFor: (tool: string, signal: AbortSignal) => PrivilegedHost | undefined;
+    /**
+     * Every secret value the user tool `tool` may read. A failure's cause code that overlaps any of
+     * the run's values is not sent to the worker; without this, no cause code is sent.
+     */
+    readableSecretValues?: (tool: string) => Promise<string[]>;
     drivability: () => Promise<RunDrivability>;
     launcher: WorkerLauncher;
 }