@yielded/agent-platform-cloudflare 0.1.0-beta.172 → 0.1.0-beta.174

package/src/InteractiveBrowser.ts

@@ -527,6 +527,8 @@ const makeProductionCdpSession = (session: CDPSession): BrowserRunInteractiveCdp
   detach: () => session.detach(),
 });
 
+// Native Puppeteer adapter control signal; never enters the Effect failure channel.
+// @effect-diagnostics-next-line extendsNativeError:off
 class BrowserRunActionUndispatched extends Error {
   readonly matchCount: number;
 
@@ -549,8 +551,10 @@ const readActionTarget = (page: Page, selector: string): Promise<unknown> =>
       if (cause instanceof Error && cause.name === "SyntaxError") {
         return { matchCount: 0, invalidSelector: true };
       }
+      // oxlint-disable-next-line effect/no-untyped-throw -- Preserve the original Chromium/Puppeteer exception at this native SDK callback boundary.
       throw cause;
     }
+    // oxlint-disable-next-line effect/no-untyped-throw, effect/no-native-error -- Runs in Chromium through page.evaluate; Effect is unavailable in that realm.
     if (typeof matches !== "object" || matches === null) throw new Error("Invalid query result");
     const matchCount = Math.min(10_000, Reflect.get(matches, "length"));
     const element = Reflect.get(matches, 0);
@@ -726,6 +730,7 @@ const makeActionRequestTracker = (page: Page, signal: AbortSignal) => {
     if (signal.aborted) close();
   } catch (cause) {
     close();
+    // oxlint-disable-next-line effect/no-untyped-throw -- Preserve the original Chromium/Puppeteer exception at this native SDK callback boundary.
     throw cause;
   }
 
@@ -1151,6 +1156,7 @@ const runObservedPageAction = async (
   validate?: (element: NonNullable<Awaited<ReturnType<Page["$"]>>>) => Promise<boolean>,
   onComplete?: () => void,
 ): Promise<unknown> => {
+  // oxlint-disable-next-line effect/no-untyped-throw -- Native Puppeteer input port reports non-dispatch before the Effect owner classifies the result.
   if (signal.aborted) throw new BrowserRunActionUndispatched(0);
 
   const before = Schema.decodeUnknownSync(ActionTargetState)(
@@ -1158,6 +1164,7 @@ const runObservedPageAction = async (
   );
 
   if (before.matchCount !== 1 || before.invalidSelector === true) {
+    // oxlint-disable-next-line effect/no-untyped-throw -- Native Puppeteer input port reports non-dispatch before the Effect owner classifies the result.
     throw new BrowserRunActionUndispatched(before.matchCount);
   }
   // Resolve one CSS match inside this action's native adapter boundary. The
@@ -1173,6 +1180,7 @@ const runObservedPageAction = async (
         requestedSelector,
       ]);
 
+      // oxlint-disable-next-line effect/no-untyped-throw, effect/no-native-error -- Runs in Chromium through page.evaluate; Effect is unavailable in that realm.
       if (typeof matches !== "object" || matches === null) throw new Error("Invalid query result");
       const count = Reflect.get(matches, "length");
 
@@ -1183,6 +1191,7 @@ const runObservedPageAction = async (
 
   try {
     if (!(target instanceof ElementHandle)) {
+      // oxlint-disable-next-line effect/no-untyped-throw -- Native Puppeteer input port reports non-dispatch before the Effect owner classifies the result.
       throw new BrowserRunActionUndispatched(
         Schema.decodeUnknownSync(Schema.Natural)(await target.jsonValue()),
       );
@@ -1195,6 +1204,7 @@ const runObservedPageAction = async (
   }
   if (signal.aborted) {
     await disposeActionHandles([element]);
+    // oxlint-disable-next-line effect/no-untyped-throw -- Native Puppeteer input port reports non-dispatch before the Effect owner classifies the result.
     throw new BrowserRunActionUndispatched(1);
   }
 
@@ -1209,10 +1219,12 @@ const runObservedPageAction = async (
   signal.addEventListener("abort", onAbort, { once: true });
   try {
     if (validate !== undefined && !(await validate(element)))
+      // oxlint-disable-next-line effect/no-untyped-throw -- Native Puppeteer input port reports non-dispatch before the Effect owner classifies the result.
       throw new BrowserRunActionUndispatched(1);
     tracker = makeActionRequestTracker(page, signal);
     // No await between the final cancellation fence and SDK dispatch. Once
     // dispatched, interruption is uncertain, even if the SDK later resolves.
+    // oxlint-disable-next-line effect/no-untyped-throw -- Native Puppeteer input port reports non-dispatch before the Effect owner classifies the result.
     if (signal.aborted) throw new BrowserRunActionUndispatched(1);
     onDispatch();
     const inputStarted = performance.now();
@@ -1254,6 +1266,7 @@ const guardedPageInput = async (
     }),
   );
 
+  // oxlint-disable-next-line effect/no-untyped-throw -- Native Puppeteer input port reports non-dispatch before the Effect owner classifies the result.
   if (observed._tag !== "Text") throw new BrowserRunActionUndispatched(1);
 };
 
@@ -1281,6 +1294,7 @@ const makeProductionPage = (page: Page): BrowserRunInteractivePage => {
       try {
         await page.close();
       } catch (cause) {
+        // oxlint-disable-next-line effect/no-untyped-throw -- Preserve the original Chromium/Puppeteer exception at this native SDK callback boundary.
         if (!isRemoteClosure(cause)) throw cause;
       }
     },
@@ -1338,6 +1352,7 @@ const makeProductionPage = (page: Page): BrowserRunInteractivePage => {
                   prototype = Reflect.getPrototypeOf(prototype);
                 }
                 if (setValue === undefined) {
+                  // oxlint-disable-next-line effect/no-untyped-throw, effect/no-native-error -- Runs inside the Chromium evaluate callback, whose failures cross CDP as native exceptions.
                   throw new Error("The selector did not resolve to a fillable field");
                 }
                 const focus = Reflect.get(element, "focus");
@@ -1418,6 +1433,7 @@ const makeProductionContext = (
     try {
       await context.close();
     } catch (cause) {
+      // oxlint-disable-next-line effect/no-untyped-throw -- Preserve the original Chromium/Puppeteer exception at this native SDK callback boundary.
       if (!isRemoteClosure(cause)) throw cause;
     }
   },
@@ -1437,6 +1453,7 @@ const makeProductionBrowser = (
     if (context === undefined) return undefined;
     const pages = await context.pages();
 
+    // oxlint-disable-next-line effect/no-untyped-throw, effect/no-native-error -- Native browser reattachment port rejects an oversized SDK inventory; the Effect caller maps the failure.
     if (pages.length > 64) throw new Error("The browser target inventory exceeds its bound");
     for (const candidate of pages) {
       const page = makeProductionPage(candidate);
@@ -1455,6 +1472,7 @@ const makeProductionBrowser = (
     try {
       await browser.close();
     } catch (cause) {
+      // oxlint-disable-next-line effect/no-untyped-throw -- Preserve the original Chromium/Puppeteer exception at this native SDK callback boundary.
       if (!isRemoteClosure(cause)) throw cause;
     }
   },
@@ -1605,6 +1623,8 @@ const hostAllowed = (policy: InteractiveBrowserPolicySnapshot, value: string): b
 const keepAliveMillis = (policy: InteractiveBrowserPolicySnapshot): number =>
   Math.max(MIN_KEEP_ALIVE_MILLIS, Math.min(MAX_KEEP_ALIVE_MILLIS, policy.maxElapsedMillis));
 
+// Native acquisition cancellation signal, intercepted before mapping to an Effect failure.
+// @effect-diagnostics-next-line extendsNativeError:off
 class LateBrowserAcquisition extends Error {}
 
 const closeLateAcquisition = async <A>(
@@ -1623,6 +1643,7 @@ const closeLateAcquisition = async <A>(
   } catch {
     // The captured runtime reports cleanup failures before this callback absorbs rejection.
   }
+  // oxlint-disable-next-line effect/no-untyped-throw -- Reject a late native SDK acquisition after cleanup; the interrupted Effect no longer owns it.
   throw new LateBrowserAcquisition("The interrupted browser acquisition completed late");
 };
 
@@ -2806,15 +2827,19 @@ const makeHostService = (
           resume === undefined
             ? undefined
             : yield* withinDeadline(
-                Effect.tryPromise({
-                  try: async () => {
-                    if (browser.reattach === undefined || browser.detach === undefined)
-                      throw new Error("The browser binding does not support exact reattachment");
-
-                    return await browser.reattach(resume.page);
-                  },
-                  catch: (cause) =>
-                    protocolError("Reattaching the exact browser page failed", cause),
+                Effect.gen(function* () {
+                  if (browser.reattach === undefined || browser.detach === undefined)
+                    return yield* protocolError(
+                      "The browser binding does not support exact reattachment",
+                    );
+
+                  const reattach = browser.reattach.bind(browser);
+
+                  return yield* Effect.tryPromise({
+                    try: () => reattach(resume.page),
+                    catch: (cause) =>
+                      protocolError("Reattaching the exact browser page failed", cause),
+                  });
                 }).pipe(
                   Effect.timeoutOrElse({
                     duration: "10 seconds",
@@ -3032,15 +3057,16 @@ const makeHostService = (
         );
 
         const pageIdentity = yield* Effect.cached(
-          Effect.tryPromise({
-            try: async () => {
-              if (page.identity === undefined)
-                throw new Error("The browser binding does not expose page identity");
+          Effect.gen(function* () {
+            if (page.identity === undefined)
+              return yield* protocolError("The browser binding does not expose page identity");
+            const identity = page.identity.bind(page);
 
-              return await page.identity();
-            },
-            catch: (cause) =>
-              protocolError("Reading the exact browser page identity failed", cause),
+            return yield* Effect.tryPromise({
+              try: () => identity(),
+              catch: (cause) =>
+                protocolError("Reading the exact browser page identity failed", cause),
+            });
           }).pipe(
             Effect.catchTag("InteractiveBrowserProtocolError", (error) =>
               failReportedProtocol("interactive.checkpoint", error),

package/src/ThreadObject.ts

@@ -324,24 +324,31 @@ const gateAdmissionLimits = Effect.fnUntraced(function* (
   const ledger = yield* SubmissionLedger;
   const { ctx } = yield* DurableObjectContext;
 
-  const existing = yield* ledger.lookup(
-    SubmissionLookupByKey.make({
-      threadId,
-      principal: request.principal,
-      idempotencyKey: request.idempotencyKey,
-    }),
-  );
-
-  if (Option.isSome(existing)) return;
+  // Admission checks the key durably. The host needs an extra lookup only to
+  // exempt a retained receipt when a current limit would otherwise refuse it.
+  const refuseFresh = (error: AdmissionLimitExceeded) =>
+    ledger
+      .lookup(
+        SubmissionLookupByKey.make({
+          threadId,
+          principal: request.principal,
+          idempotencyKey: request.idempotencyKey,
+        }),
+      )
+      .pipe(
+        Effect.flatMap((existing) => (Option.isSome(existing) ? Effect.void : Effect.fail(error))),
+      );
 
   const inputBytes = utf8Bytes(request.inputPayload);
 
   if (inputBytes > config.limits.maxInputBytes) {
-    return yield* AdmissionLimitExceeded.make({
-      limit: "input-bytes",
-      actual: inputBytes,
-      maximum: config.limits.maxInputBytes,
-    });
+    return yield* refuseFresh(
+      AdmissionLimitExceeded.make({
+        limit: "input-bytes",
+        actual: inputBytes,
+        maximum: config.limits.maxInputBytes,
+      }),
+    );
   }
 
   const nonterminal = yield* ledger.scanNonterminal.pipe(
@@ -350,21 +357,25 @@ const gateAdmissionLimits = Effect.fnUntraced(function* (
   );
 
   if (nonterminal.length >= config.limits.maxQueueDepthPerLane) {
-    return yield* AdmissionLimitExceeded.make({
-      limit: "queue-depth",
-      actual: nonterminal.length,
-      maximum: config.limits.maxQueueDepthPerLane,
-    });
+    return yield* refuseFresh(
+      AdmissionLimitExceeded.make({
+        limit: "queue-depth",
+        actual: nonterminal.length,
+        maximum: config.limits.maxQueueDepthPerLane,
+      }),
+    );
   }
 
   const databaseBytes = yield* Effect.sync(() => ctx.storage.sql.databaseSize);
 
   if (databaseBytes > config.limits.maxDatabaseBytes) {
-    return yield* AdmissionLimitExceeded.make({
-      limit: "database-bytes",
-      actual: databaseBytes,
-      maximum: config.limits.maxDatabaseBytes,
-    });
+    return yield* refuseFresh(
+      AdmissionLimitExceeded.make({
+        limit: "database-bytes",
+        actual: databaseBytes,
+        maximum: config.limits.maxDatabaseBytes,
+      }),
+    );
   }
 });
 

package/src/WakeScheduler.ts

@@ -1,3 +1,4 @@
+import { CurrentNativeSource } from "@yielded/agent-storage-cloudflare/port-routing";
 import { type ThreadId } from "@yielded/agent/identifiers";
 import { makeWakeSubscriptionHub, WakeScheduler } from "@yielded/agent/wake-scheduler";
 import { Effect, Layer, PubSub, Schema, Stream } from "effect";
@@ -31,7 +32,7 @@ class RemoteWakeDropped extends Schema.TaggedError<RemoteWakeDropped>()("RemoteW
  * - `notify(local)` wakes progress and settlement registrations, publishes a worker hint, and
  *   schedules the earliest alarm. Processing an owned Thread defers immediate alarms until
  *   processing exits; pre-armed recovery deadlines remain active. Progress hints skip settlement
- *   registrations only.
+ *   registrations; single-Thread native progress also omits the redundant worker hint.
  * - `notify(remote)` → fire-and-forget `wake()` on the owning Object's stub with every error
  *   swallowed and logged: hints are droppable, and the target's own alarm/scan pairing (the
  *   maintenance pass re-polls unsettled children) guarantees liveness without this call.
@@ -59,15 +60,17 @@ export const cloudflareWakeSchedulerLayer: Layer.Layer<
       ),
     );
 
-    const notifyLocal = (threadId: ThreadId, kind?: "progress") =>
-      (kind === "progress"
+    const notifyLocal = Effect.fnUntraced(function* (threadId: ThreadId, kind?: "progress") {
+      yield* kind === "progress"
         ? progress.notify(threadId)
-        : settlements.notify(threadId).pipe(Effect.andThen(progress.notify(threadId)))
-      ).pipe(
-        Effect.andThen(PubSub.publish(hints, threadId)),
-        Effect.andThen(scheduleLocal),
-        Effect.asVoid,
-      );
+        : settlements.notify(threadId).pipe(Effect.andThen(progress.notify(threadId)));
+
+      // Progress waiters still observe every hint. The single-Thread maintenance loop
+      // already awaits the running native fiber; its source commits enroll auxiliary work.
+      if (kind !== "progress" || placement.threadId === undefined || !(yield* CurrentNativeSource))
+        yield* PubSub.publish(hints, threadId);
+      yield* scheduleLocal;
+    });
 
     const notifyRemote = (threadId: ThreadId) =>
       callThreadObject(

package/src/internal/browser-binding.ts

@@ -69,10 +69,12 @@ export class BrowserRunBinding extends Context.Service<
         } catch {
           // Preserve the provider refusal when local response release also fails.
         }
+        // oxlint-disable-next-line effect/no-untyped-throw -- Native BrowserRun acquisition Promise preserves the provider refusal after body cleanup.
         throw failure;
       }
       const socket = response.webSocket;
 
+      // oxlint-disable-next-line effect/no-untyped-throw -- Native BrowserRun upgrade Promise must reject a malformed WebSocket response.
       if (socket === null) throw new BrowserRunFailure({ operation, reason: "malformed" });
 
       return socket;
@@ -98,6 +100,7 @@ export class BrowserRunBinding extends Context.Service<
           } catch {
             // Body cancellation cannot replace the acquisition refusal.
           }
+          // oxlint-disable-next-line effect/no-untyped-throw -- Native BrowserRun acquisition Promise preserves the provider refusal after body cleanup.
           throw failure;
         }
 
@@ -115,6 +118,7 @@ export class BrowserRunBinding extends Context.Service<
         const transport: ConnectionTransport = {
           send: (message) => {
             if (retired || socket === undefined)
+              // oxlint-disable-next-line effect/no-untyped-throw -- Native Puppeteer transport rejects fenced dispatch or initialization; its Effect owner maps the failure.
               throw new BrowserRunFailure({ operation, reason: "provider" });
             socket.send(message);
           },
@@ -153,6 +157,7 @@ export class BrowserRunBinding extends Context.Service<
           } catch (cause) {
             retirementFailure ??= browserFailure(disconnectOperation, cause);
           }
+          // oxlint-disable-next-line effect/no-untyped-throw -- Native transport close callback preserves the first retirement failure for its Effect owner.
           if (retirementFailure !== undefined) throw retirementFailure;
         };
 
@@ -177,6 +182,7 @@ export class BrowserRunBinding extends Context.Service<
               // failure independently of the cancellation already returned to the owner.
               retireNow();
               signal?.throwIfAborted();
+              // oxlint-disable-next-line effect/no-untyped-throw -- Native Puppeteer transport rejects fenced dispatch or initialization; its Effect owner maps the failure.
               throw new BrowserRunFailure({ operation, reason: "provider" });
             }
             socket.addEventListener("message", onMessage);
@@ -207,6 +213,7 @@ export class BrowserRunBinding extends Context.Service<
               signal?.aborted === true &&
               (cause === signal.reason || (closedByAbort && cause.name === "TargetCloseError"));
 
+            // oxlint-disable-next-line effect/no-untyped-throw -- Native SDK initialization Promise preserves cancellation provenance after transport retirement.
             throw localCancellation ? reportedBrowserError(failure) : failure;
           } finally {
             signal?.removeEventListener("abort", abort);
@@ -257,6 +264,7 @@ export class BrowserRunBinding extends Context.Service<
                 if (acquired !== undefined) await runReport(release(acquired));
                 if (signal.aborted && cause !== signal.reason)
                   await runReport(reportBrowserCause(operation, Cause.fail(cause)));
+                // oxlint-disable-next-line effect/no-untyped-throw -- Rethrow the foreign upgrade failure after late-acquisition cleanup, preserving abort identity.
                 throw cause;
               }
             },

package/src/internal/browser-credentials.ts

@@ -134,7 +134,7 @@ export const fillCredential = Effect.fnUntraced(function* (
   let filled = 0;
 
   const fail = (reason: CredentialFillError["reason"]) =>
-    new CredentialFillError({ reason, dispatch, filled, cleanup: "not-requested" });
+    CredentialFillError.make({ reason, dispatch, filled, cleanup: "not-requested" });
 
   const remote = <A>(run: (signal: AbortSignal) => Promise<A>) =>
     Effect.tryPromise({
@@ -164,28 +164,33 @@ export const fillCredential = Effect.fnUntraced(function* (
 
         if (signal.aborted) {
           await Promise.all(handles.map((handle) => handle.dispose().catch(() => {})));
-          throw fail("provider");
+
+          return undefined;
         }
 
         return handles;
-      }).pipe(Effect.interruptible),
+      }).pipe(
+        Effect.filterOrFail(
+          (handles) => handles !== undefined,
+          () => fail("provider"),
+        ),
+        Effect.interruptible,
+      ),
       release,
     );
 
-  const origin = (value: string) =>
-    Effect.try({
-      try: () => {
-        const url = new URL(value);
+  const origin = Effect.fnUntraced(function* (value: string) {
+    const url = yield* Effect.try({
+      try: () => new URL(value),
+      catch: () => fail("denied"),
+    });
 
-        if (url.username || url.password) throw fail("denied");
+    if (url.username || url.password) return yield* fail("denied");
 
-        return url.origin;
-      },
-      catch: () => fail("denied"),
-    }).pipe(
-      Effect.flatMap(Schema.decodeUnknownEffect(CredentialOrigin)),
+    return yield* Schema.decodeEffect(CredentialOrigin)(url.origin).pipe(
       Effect.mapError(() => fail("denied")),
     );
+  });
 
   return yield* Effect.gen(function* () {
     const request = yield* Schema.decodeEffect(FillCredentialRequest, {

package/src/internal/browser-file-selection.ts

@@ -14,6 +14,7 @@ function setFileSelection(element: object, encoded: string, name: string, type:
     Reflect.get(element, "disabled") ||
     Reflect.get(element, "webkitdirectory")
   ) {
+    // oxlint-disable-next-line effect/no-untyped-throw, effect/no-native-error -- Runs in Chromium; a native exception is the CDP evaluation failure protocol.
     throw new Error("The target is not an enabled file input");
   }
   const bytes = Uint8Array.from(atob(encoded), (character) => character.charCodeAt(0));
@@ -30,6 +31,7 @@ function setFileSelection(element: object, encoded: string, name: string, type:
     selected[0]?.name !== name ||
     selected[0]?.type !== type
   ) {
+    // oxlint-disable-next-line effect/no-untyped-throw, effect/no-native-error -- Runs in Chromium; a native exception is the CDP evaluation failure protocol.
     throw new Error("The input did not retain the selected file");
   }
   const dispatch = Reflect.get(element, "dispatchEvent");
@@ -48,7 +50,9 @@ export const makeFileSelection =
         await session.send("Page.enable");
         await session.send("Page.setInterceptFileChooserDialog", { enabled: true });
       } catch (cause) {
-        await session.detach();
+        // Initialization remains the primary failure if best-effort cleanup also rejects.
+        await session.detach().catch(() => {});
+        // oxlint-disable-next-line effect/no-untyped-throw -- Preserve the original CDP initialization failure after detaching its session.
         throw cause;
       }
     }
@@ -68,11 +72,14 @@ export const makeFileSelection =
       const opened = new Promise<number>((resolve, reject) => {
         onOpened = (event) =>
           event.backendNodeId === undefined
-            ? reject(new Error("The chooser has no file input"))
+            ? // oxlint-disable-next-line effect/no-native-error -- Native CDP file-chooser port rejects through its Promise; its Effect caller owns typed error mapping.
+              reject(new Error("The chooser has no file input"))
             : resolve(event.backendNodeId);
+        // oxlint-disable-next-line effect/no-native-error -- Native CDP file-chooser port rejects through its Promise; its Effect caller owns typed error mapping.
         onAbort = () => reject(new Error("File selection interrupted"));
         session.on("Page.fileChooserOpened", onOpened);
         signal.addEventListener("abort", onAbort, { once: true });
+        // oxlint-disable-next-line effect/no-native-error -- Native CDP file-chooser port rejects through its Promise; its Effect caller owns typed error mapping.
         timer = setTimeout(() => reject(new Error("No file chooser opened")), 5_000);
         if (signal.aborted) onAbort();
       });
@@ -80,12 +87,15 @@ export const makeFileSelection =
       try {
         const [backendNodeId] = await Promise.all([opened, element.click()]);
 
+        // oxlint-disable-next-line effect/no-untyped-throw, effect/no-native-error -- Native CDP file-chooser port rejects through its Promise; its Effect caller owns typed error mapping.
         if (signal.aborted) throw new Error("File selection interrupted");
         const resolved = await session.send("DOM.resolveNode", { backendNodeId });
 
         const objectId = resolved.object.objectId;
 
+        // oxlint-disable-next-line effect/no-untyped-throw, effect/no-native-error -- Native CDP file-chooser port rejects through its Promise; its Effect caller owns typed error mapping.
         if (objectId === undefined) throw new Error("The chooser has no file input");
+        // oxlint-disable-next-line effect/no-untyped-throw, effect/no-native-error -- Native CDP file-chooser port rejects through its Promise; its Effect caller owns typed error mapping.
         if (signal.aborted) throw new Error("File selection interrupted");
 
         const result = await session.send("Runtime.callFunctionOn", {
@@ -100,6 +110,7 @@ export const makeFileSelection =
         });
 
         if (result.exceptionDetails !== undefined)
+          // oxlint-disable-next-line effect/no-untyped-throw, effect/no-native-error -- Native CDP file-chooser port rejects through its Promise; its Effect caller owns typed error mapping.
           throw new Error("The chooser did not select the file");
       } finally {
         clearTimeout(timer);

package/src/internal/browser-quick-action.ts

@@ -290,6 +290,7 @@ const navigationError = (message: string, cause?: unknown): PageCaptureNavigatio
 
 /** Preserve bounded remote diagnostics for the host without exposing their text to a model. */
 const privateResponseCause = (bodyText: string, response: Response): Error =>
+  // oxlint-disable-next-line effect/no-native-error -- Bounded foreign response diagnostic retains host metadata as cause, never as the Effect failure.
   new Error(boundedDiagnostic(bodyText), {
     cause: {
       provider: "cloudflare-browser-run",