condukt 0.25.0 → 0.27.0

package/dist/runtimes/copilot/sdk-backend.js

@@ -51,6 +51,8 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const node_crypto_1 = require("node:crypto");
 const types_1 = require("../../src/types");
+const session_recovery_policy_1 = require("../../src/session-recovery-policy");
+const mcp_env_1 = require("../mcp-env");
 const lifecycle_events_1 = require("./lifecycle-events");
 const subagents_1 = require("./subagents");
 const SEVERITY_RANK = {
@@ -81,35 +83,32 @@ function writeDiagnosticStderr(severity, message, configuredLevel) {
         /* closed stream */
     }
 }
-const MAX_SESSION_RECOVERY_CONTINUATIONS = 23;
-function positiveIntegerOr(value, fallback) {
-    return value !== undefined && Number.isFinite(value) && value > 0
-        ? Math.trunc(value)
-        : fallback;
-}
-function nonNegativeOr(value, fallback) {
-    return value !== undefined && Number.isFinite(value) && value >= 0
-        ? value
-        : fallback;
-}
-function effectiveSessionRecoveryPolicy(policy) {
-    if (policy === false)
-        return undefined;
-    const configured = policy ?? {};
-    return {
-        maxContinuations: Math.min(MAX_SESSION_RECOVERY_CONTINUATIONS, positiveIntegerOr(configured.maxContinuations, types_1.DEFAULT_SESSION_RECOVERY_POLICY.maxContinuations)),
-        budgetMs: nonNegativeOr(configured.budgetMs, types_1.DEFAULT_SESSION_RECOVERY_POLICY.budgetMs),
-        backoffBaseMs: positiveIntegerOr(configured.backoffBaseMs, types_1.DEFAULT_SESSION_RECOVERY_POLICY.backoffBaseMs),
-        backoffMaxMs: positiveIntegerOr(configured.backoffMaxMs, types_1.DEFAULT_SESSION_RECOVERY_POLICY.backoffMaxMs),
-        jitter: configured.jitter ?? types_1.DEFAULT_SESSION_RECOVERY_POLICY.jitter,
-        nativeRetryGraceMs: nonNegativeOr(configured.nativeRetryGraceMs, types_1.DEFAULT_SESSION_RECOVERY_POLICY.nativeRetryGraceMs),
-    };
+/**
+ * A failed reconnect step, tagged with the stage that threw so an `exhausted`
+ * event can name it.
+ *
+ * `fatal` marks the two steps whose failure cannot change its answer on a
+ * retry: a missing client factory, and a resumed session whose id is not the one
+ * we asked for. Every other step is retried until the continuation count or the
+ * recovery budget runs out.
+ */
+class SessionResumeAttemptError extends Error {
+    stage;
+    fatal;
+    constructor(stage, message, fatal, options) {
+        super(message, options);
+        this.stage = stage;
+        this.fatal = fatal;
+        this.name = 'SessionResumeAttemptError';
+    }
 }
-function recoveryDelayMs(policy, failedContinuation) {
-    const exponent = Math.min(52, Math.max(0, failedContinuation));
-    const capped = Math.min(policy.backoffMaxMs, policy.backoffBaseMs * (2 ** exponent));
-    const delayed = policy.jitter ? Math.random() * capped : capped;
-    return Math.max(100, Number.isFinite(delayed) ? delayed : 100);
+function toResumeAttemptError(value, stage) {
+    if (value instanceof SessionResumeAttemptError)
+        return value;
+    const message = value instanceof Error ? value.message : String(value);
+    return new SessionResumeAttemptError(stage, message, false, {
+        cause: value instanceof Error ? value : undefined,
+    });
 }
 function numericStatusCode(value) {
     if (typeof value === 'number' && Number.isFinite(value))
@@ -119,6 +118,48 @@ function numericStatusCode(value) {
     const parsed = Number(value);
     return Number.isFinite(parsed) ? parsed : undefined;
 }
+/**
+ * The CLI and the SDK describe a failed model call differently.
+ *
+ * The SDK surfaces `model.call_failure` in its typed shape: `source`,
+ * `failureKind`, `transport`, `errorMessage` and friends, flat and camelCase,
+ * with `source` always set. The CLI emits `model.model_call_failure` (routed
+ * here by the type-substring branch in `dispatchClassEvent`) in its own
+ * envelope: the details nested under `modelCall` in snake_case, and no `source`
+ * anywhere.
+ *
+ * Both land in `handleModelCallFailure`, so classification reads one view of
+ * either. Without this the recovery predicate, which tests `source ===
+ * 'top_level'` first, rejected every transport failure that arrived in the CLI
+ * shape, and the run restarted the node from a cold session instead of
+ * resuming it.
+ *
+ * The original envelope is kept alongside the unwrapped fields: the failure log
+ * still shows exactly what arrived, and the added keys are the ones the
+ * classifier reads.
+ */
+function normalizeModelCallFailure(data) {
+    if (!data)
+        return data;
+    const nested = isRecord(data.modelCall) ? data.modelCall : undefined;
+    // Already the flat SDK shape, or nothing to unwrap: leave it alone.
+    if (!nested)
+        return data;
+    return {
+        ...data,
+        failureKind: data.failureKind ?? nested.failure_kind ?? nested.failureKind,
+        transport: data.transport ?? nested.transport,
+        errorMessage: data.errorMessage ?? nested.error ?? nested.errorMessage,
+        errorCode: data.errorCode ?? nested.error_code ?? nested.errorCode,
+        apiEndpoint: data.apiEndpoint ?? nested.api_endpoint,
+        model: data.model ?? nested.model,
+        durationMs: data.durationMs ?? data.modelCallDurationMs ?? nested.durationMs,
+        // The CLI envelope carries no `source`, and an agent-scoped failure never
+        // reaches here: `handleModelCallFailure` returns on `logAgentScopedFailure`
+        // first. An absent source on this shape is the root session's own call.
+        source: typeof data.source === 'string' ? data.source : 'top_level',
+    };
+}
 function isRecoverableModelCallFailure(data) {
     if (!data)
         return false;
@@ -906,72 +947,6 @@ function parseMcpConfig(configPath, mcpServerWorkingDirectory, terminalLogLevel)
         return null;
     }
 }
-const ENV_REFERENCE = /^\$\{([A-Z_][A-Z0-9_]*(?:\|[A-Z_][A-Z0-9_]*)*)\}$/;
-/**
- * Resolves ${NAME} and ${NAME|FALLBACK|...}, taking the first variable that is set.
- *
- * The fallback chain exists because there is no single conventional name for a GitHub
- * token: the Copilot CLI itself reads COPILOT_GITHUB_TOKEN, then GH_TOKEN, then
- * GITHUB_TOKEN. A default that insisted on one spelling would silently ship an
- * unauthenticated server in any environment that chose a different one.
- */
-function resolveMcpEnvironmentValue(value) {
-    const match = ENV_REFERENCE.exec(value);
-    if (!match)
-        return value;
-    for (const name of match[1].split('|')) {
-        const resolved = process.env[name];
-        if (resolved !== undefined && resolved !== '')
-            return resolved;
-    }
-    return undefined;
-}
-function resolveMcpEnvironmentRecord(values) {
-    if (values === undefined)
-        return undefined;
-    const resolved = {};
-    for (const [key, value] of Object.entries(values)) {
-        const environmentValue = resolveMcpEnvironmentValue(value);
-        if (environmentValue !== undefined)
-            resolved[key] = environmentValue;
-    }
-    return Object.keys(resolved).length > 0 ? resolved : undefined;
-}
-// Embedded references, so `Bearer ${A|B}` resolves rather than only a bare `${A|B}`. The
-// fallback alternatives must be part of the pattern: a reference matcher without them finds
-// nothing in `${A|B}`, leaves the value untouched, and emits the placeholder as a literal
-// header — an unauthenticated server that reports no error and simply returns no tools.
-const HEADER_ENV_REFERENCE = /\$\{([A-Z_][A-Z0-9_]*(?:\|[A-Z_][A-Z0-9_]*)*)\}/g;
-function resolveMcpHeaders(headers, terminalLogLevel) {
-    if (headers === undefined)
-        return undefined;
-    const resolved = {};
-    for (const [key, value] of Object.entries(headers)) {
-        const references = [...value.matchAll(HEADER_ENV_REFERENCE)];
-        let resolvedValue = value;
-        let complete = true;
-        for (const reference of references) {
-            const names = reference[1].split('|');
-            const environmentValue = names
-                .map((name) => process.env[name])
-                .find((candidate) => candidate !== undefined && candidate !== '');
-            if (environmentValue === undefined) {
-                // Dropping the header is deliberate — a missing credential must not abort a run — but
-                // it is invisible at the server, which just answers with nothing.
-                try {
-                    writeDiagnosticStderr('warning', `[SdkBackend] MCP header ${key} dropped: none of ${names.join(', ')} is set\n`, terminalLogLevel);
-                }
-                catch { /* diagnostics must not break configuration */ }
-                complete = false;
-                break;
-            }
-            resolvedValue = resolvedValue.replace(reference[0], environmentValue);
-        }
-        if (complete)
-            resolved[key] = resolvedValue;
-    }
-    return Object.keys(resolved).length > 0 ? resolved : undefined;
-}
 function toSdkMcpServers(servers, terminalLogLevel) {
     if (servers === undefined || servers === false)
         return servers;
@@ -981,14 +956,19 @@ function toSdkMcpServers(servers, terminalLogLevel) {
         if (!parsed)
             continue;
         if ('url' in parsed) {
-            const headers = resolveMcpHeaders(parsed.headers, terminalLogLevel);
+            const headers = (0, mcp_env_1.resolveMcpHeaders)(parsed.headers, ({ header, names }) => {
+                try {
+                    writeDiagnosticStderr('warning', `[SdkBackend] MCP header ${header} dropped: none of ${names.join(', ')} is set\n`, terminalLogLevel);
+                }
+                catch { /* diagnostics must not break configuration */ }
+            });
             converted[name] = {
                 ...parsed,
                 ...(headers !== undefined ? { headers } : { headers: undefined }),
             };
         }
         else {
-            const env = resolveMcpEnvironmentRecord(parsed.env);
+            const env = (0, mcp_env_1.resolveMcpEnvironmentRecord)(parsed.env);
             converted[name] = {
                 ...parsed,
                 ...(env !== undefined ? { env } : { env: undefined }),
@@ -1115,6 +1095,13 @@ class SdkSession {
     deferredIdle = false;
     parentUsage;
     turnSettled = false;
+    /**
+     * Resolvers parked by `continueSession`, settled by the *next* idle/error.
+     * `continueSession` owns the wait for its own turn so `agent()` does not have
+     * to re-register idle/error handlers it cannot remove (the session interface
+     * has no `off`).
+     */
+    settleWaiters = [];
     aborted = false;
     sessionId;
     originalPrompt;
@@ -1227,6 +1214,9 @@ class SdkSession {
             this.emitError(new Error('Session is aborted'));
             return;
         }
+        // A parked `continueSession` belongs to the previous turn. This is a fresh
+        // lifecycle; leaving it parked would hang its caller forever.
+        this.rejectContinuation(new Error('Session was restarted before the continuation settled'));
         this.originalPrompt = prompt;
         this.sessionId = undefined;
         this.sdkSessionConfigFactory = undefined;
@@ -1262,6 +1252,67 @@ class SdkSession {
             this.fail(err instanceof Error ? err : new Error(String(err)), 'session.run');
         });
     }
+    /**
+     * Append one more user turn to the live session and resolve when it settles.
+     *
+     * This is the warm counterpart to `send()`: it never creates or resumes a
+     * session, so whatever the first turn built stays intact. `agent()` uses it to
+     * ask for a declared output the first turn forgot.
+     *
+     * Rejects when the session is aborted, the handle is gone, a compaction owns
+     * the session, the transport refuses the turn, or the turn itself fails. Every
+     * rejection means "no continuation happened"; callers report the miss rather
+     * than falling back to a cold restart.
+     */
+    async continueSession(prompt) {
+        if (this.aborted)
+            throw new Error('Session is aborted');
+        // A recovery in flight is already resuming this session; let it finish so we
+        // send the continuation over whatever handle it installs.
+        if (this.recoveryInProgress)
+            await this.recoveryInProgress;
+        if (this.aborted)
+            throw new Error('Session is aborted');
+        if (this.activeCompactionEventId !== undefined) {
+            throw new Error('Session is compacting; cannot continue the turn');
+        }
+        const handle = this._sdkSession;
+        if (!handle)
+            throw new Error('Session handle is gone; cannot continue the turn');
+        // Reopen the turn so idle, the heartbeat and `fail()` treat the
+        // continuation as live rather than as an already-settled turn.
+        this.turnSettled = false;
+        this.deferredIdle = false;
+        this._turnText.clear();
+        this.lastForwardProgressAt = Date.now();
+        this.lastForwardProgressType = 'continuation-prompt';
+        const waiter = { resolve: () => undefined, reject: () => undefined };
+        const settled = new Promise((resolve, reject) => {
+            waiter.resolve = resolve;
+            waiter.reject = reject;
+        });
+        this.settleWaiters.push(waiter);
+        // The attempt deadline is absolute, so this re-arms the remainder of it
+        // rather than granting the continuation a fresh budget.
+        this.rearmHardTimeout(handle);
+        this.resetHeartbeat();
+        try {
+            await handle.rpc.sendMessages({
+                messages: [{ prompt, displayPrompt: prompt }],
+                wait: false,
+            });
+        }
+        catch (error) {
+            this.removeContinuationWaiter(waiter);
+            throw error instanceof Error ? error : new Error(String(error));
+        }
+        await settled;
+    }
+    removeContinuationWaiter(waiter) {
+        const index = this.settleWaiters.indexOf(waiter);
+        if (index >= 0)
+            this.settleWaiters.splice(index, 1);
+    }
     /**
      * Internal async entrypoint that creates the client, session, wires events,
      * sends the prompt, and handles lifecycle.
@@ -1896,7 +1947,7 @@ class SdkSession {
         });
     }
     scheduleRecovery(failedHandle, error, data, eventId, options = {}) {
-        const policy = effectiveSessionRecoveryPolicy(this.config.sessionRecovery);
+        const policy = (0, session_recovery_policy_1.effectiveSessionRecoveryPolicy)(this.config.sessionRecovery);
         if (!policy) {
             const eventType = data?.failureKind === 'session-progress-timeout'
                 ? 'session.progress_timeout'
@@ -1928,7 +1979,7 @@ class SdkSession {
         }
         this.recoveryStartedAt ??= Date.now();
         this.recoveryDeadlineMs ??= Math.min(this.sessionDeadlineMs ?? Number.POSITIVE_INFINITY, this.recoveryStartedAt + policy.budgetMs);
-        const delayMs = recoveryDelayMs(policy, this.recoveryContinuation);
+        const delayMs = (0, session_recovery_policy_1.recoveryDelayMs)(policy, this.recoveryContinuation);
         this.emitRecovery('scheduled', policy, this.recoveryContinuation + 1, sessionId, {
             delayMs,
             ...this.recoveryMetadata(data),
@@ -1972,49 +2023,126 @@ class SdkSession {
                 this.exhaustRecovery(policy, sessionId, originalError, 'balanced root history has no terminal completion evidence', data);
                 return;
             }
-            this.recoveryContinuation += 1;
-            this.emitRecovery('resuming', policy, this.recoveryContinuation, sessionId, {
-                ...this.recoveryMetadata(data),
-            });
-            // Fence the old handle synchronously before any asynchronous cleanup.
+            // A handshake that fails reconnects and nudges again rather than ending
+            // the turn. Every resume passes `continuePendingWork: false` and every
+            // continuation sends an empty message list, so no attempt replays a turn
+            // or re-issues a tool call: the session is left exactly where the failed
+            // turn stopped, and the next attempt resumes that same state. The
+            // continuation count and the recovery budget are what bound the loop.
+            for (;;) {
+                this.recoveryContinuation += 1;
+                this.emitRecovery('resuming', policy, this.recoveryContinuation, sessionId, {
+                    ...this.recoveryMetadata(data),
+                });
+                try {
+                    await this.attemptSameSessionResume(failedHandle, policy, before, data);
+                    return;
+                }
+                catch (attemptError) {
+                    if (this.aborted || this.turnSettled)
+                        return;
+                    const failed = toResumeAttemptError(attemptError, 'fence');
+                    if (failed.fatal
+                        || this.recoveryContinuation >= policy.maxContinuations
+                        || (this.recoveryDeadlineMs !== undefined && Date.now() >= this.recoveryDeadlineMs)) {
+                        this.exhaustRecovery(policy, sessionId, originalError, failed.message, data, failed.stage);
+                        return;
+                    }
+                    const retryDelayMs = (0, session_recovery_policy_1.recoveryDelayMs)(policy, this.recoveryContinuation);
+                    this.emitRecovery('scheduled', policy, this.recoveryContinuation + 1, sessionId, {
+                        delayMs: retryDelayMs,
+                        ...this.recoveryMetadata(data),
+                    });
+                    try {
+                        await this.waitWithinRecoveryDeadline(retryDelayMs);
+                    }
+                    catch {
+                        // The budget, not the handshake, is what ended recovery, so the
+                        // reason worth reporting is the handshake's own failure.
+                        this.exhaustRecovery(policy, sessionId, originalError, failed.message, data, failed.stage);
+                        return;
+                    }
+                }
+            }
+        }
+        catch (recoveryError) {
+            if (this.aborted || this.turnSettled)
+                return;
+            // Only the pre-flight reaches here: the initial recovery wait and the
+            // history audit that precedes the first handshake. A failing handshake is
+            // handled inside the loop, which retries it within the same bounds.
+            const normalized = recoveryError instanceof Error
+                ? recoveryError
+                : new Error(String(recoveryError));
+            this.exhaustRecovery(policy, sessionId, originalError, normalized.message, data);
+        }
+    }
+    /**
+     * One reconnect handshake: fence the failed handle, stand up a fresh client,
+     * resume the same session without replaying any turn, restore the resumed
+     * session's configuration, and nudge it with an empty message.
+     *
+     * Repeating this is safe by construction. `continuePendingWork: false` plus an
+     * empty-message send appends nothing to the transcript, so a handshake that
+     * fails at any step leaves the session where the failed turn stopped and the
+     * next attempt resumes that same state.
+     *
+     * Returns once the continuation was sent, or once the abandoned turn turns out
+     * to have completed. Throws otherwise, after tearing down whatever it built,
+     * so the caller can retry from a clean fence.
+     */
+    async attemptSameSessionResume(failedHandle, policy, before, data) {
+        const sessionId = this.sessionId;
+        if (!sessionId)
+            return;
+        let stage = 'fence';
+        try {
+            // Fence synchronously before any asynchronous cleanup. Target whatever
+            // handle is live: after a resume that succeeded through the handshake and
+            // then failed on the nudge, that is the resumed handle, not the original.
+            const handleToFence = this._sdkSession ?? failedHandle;
             this._sdkSession = null;
             this.handleGeneration += 1;
             this.activeCompactionEventId = undefined;
             this.suspendHeartbeat();
-            await failedHandle.disconnect().catch(() => undefined);
+            await handleToFence.disconnect().catch(() => undefined);
             const oldClient = this._client;
             this._client = null;
             if (oldClient) {
                 await boundedCleanup(oldClient.stop()).catch(() => undefined);
                 await oldClient.forceStop().catch(() => undefined);
             }
+            stage = 'client';
             const clientFactory = this.clientFactory;
             const configFactory = this.sdkSessionConfigFactory;
             if (!clientFactory || !configFactory) {
-                throw new Error('SDK recovery configuration is unavailable');
+                throw new SessionResumeAttemptError(stage, 'SDK recovery configuration is unavailable', true);
             }
             const client = clientFactory();
             this._client = client;
             await client.start();
             const { sessionId: _createSessionId, ...resumeConfig } = configFactory(client);
+            stage = 'resume';
             const resumed = await client.resumeSession(sessionId, {
                 ...resumeConfig,
                 continuePendingWork: false,
             });
             if (resumed.sessionId !== sessionId) {
                 await resumed.disconnect().catch(() => undefined);
-                throw new Error(`SDK resumed unexpected session '${resumed.sessionId}' instead of '${sessionId}'`);
+                throw new SessionResumeAttemptError(stage, `SDK resumed unexpected session '${resumed.sessionId}' instead of '${sessionId}'`, true);
             }
             if (this.aborted || this.turnSettled) {
                 await resumed.disconnect().catch(() => undefined);
                 return;
             }
+            stage = 'configuration';
             this._sdkSession = resumed;
             this.handleGeneration += 1;
             this.resetStateAfterResume();
             this.rearmHardTimeout(resumed);
             await this.applyResumedSessionConfiguration(resumed);
             this._wireEvents(resumed);
+            stage = 'audit';
             const afterResume = await this.auditRecoveryHistory(resumed, sessionId);
             if (afterResume.unmatchedRootTurns === 0) {
                 const taskCompletedDuringHandoff = afterResume.latestRootTurnHasTerminalResponse
@@ -2029,6 +2157,7 @@ class SdkSession {
                 // Disconnect can close the abandoned turn without completing the task.
                 // Keep the continuation path active rather than synthesizing false success.
             }
+            stage = 'continuation';
             this.lastForwardProgressAt = Date.now();
             this.lastForwardProgressType = 'continuation-sent';
             await resumed.rpc.sendMessages({ messages: [], wait: false });
@@ -2037,20 +2166,29 @@ class SdkSession {
                 ...this.recoveryMetadata(data),
             });
         }
-        catch (recoveryError) {
-            if (this.aborted || this.turnSettled)
-                return;
-            const normalized = recoveryError instanceof Error
-                ? recoveryError
-                : new Error(String(recoveryError));
-            if (this.recoveryContinuation >= policy.maxContinuations
-                || (this.recoveryDeadlineMs !== undefined && Date.now() >= this.recoveryDeadlineMs)) {
-                this.exhaustRecovery(policy, sessionId, originalError, normalized.message, data);
-                return;
-            }
-            // Resume failures are unsafe to replay blindly. They exhaust this logical
-            // turn even when numerical continuations remain.
-            this.exhaustRecovery(policy, sessionId, originalError, normalized.message, data);
+        catch (error) {
+            await this.tearDownFailedResume();
+            throw toResumeAttemptError(error, stage);
+        }
+    }
+    /**
+     * Undo a failed handshake so the next attempt fences from the state it would
+     * have started from. The attempt may already have reached the server, so both
+     * the resumed handle and the client holding it come down: a lingering client
+     * could make the SDK refuse the next resume as already active.
+     */
+    async tearDownFailedResume() {
+        const handle = this._sdkSession;
+        this._sdkSession = null;
+        this.handleGeneration += 1;
+        this.suspendHeartbeat();
+        if (handle)
+            await handle.disconnect().catch(() => undefined);
+        const client = this._client;
+        this._client = null;
+        if (client) {
+            await boundedCleanup(client.stop()).catch(() => undefined);
+            await client.forceStop().catch(() => undefined);
         }
     }
     async auditRecoveryHistory(handle, sessionId) {
@@ -2236,9 +2374,15 @@ class SdkSession {
             ...fields,
         });
     }
-    exhaustRecovery(policy, sessionId, cause, reason, data) {
+    /**
+     * `stage` names the reconnect step whose failure ended recovery, when the
+     * end came from a handshake rather than from the budget alone. The `reason`
+     * alone ("Connection is disposed.") does not say which RPC produced it.
+     */
+    exhaustRecovery(policy, sessionId, cause, reason, data, stage) {
         this.emitRecovery('exhausted', policy, this.recoveryContinuation, sessionId, {
             reason,
+            ...(stage !== undefined ? { stage } : {}),
             ...this.recoveryMetadata(data),
         });
         this.fail(new types_1.SessionRecoveryExhaustedError(`Session recovery exhausted after ${this.recoveryContinuation} continuation(s): ${reason}`, { cause }), 'session.recovery_exhausted', data);
@@ -2258,6 +2402,7 @@ class SdkSession {
             return;
         const error = new Error('Session aborted');
         this.clearTimers();
+        this.rejectContinuation(error);
         this.emitError(error);
         this.aborted = true;
         await this._cleanup();
@@ -2312,22 +2457,48 @@ class SdkSession {
     settleIdle() {
         if (this.aborted || this.turnSettled)
             return;
-        const policy = effectiveSessionRecoveryPolicy(this.config.sessionRecovery);
-        if (policy && this.recoveryContinuation > 0 && this.sessionId) {
+        // A parked waiter means this idle closes a declared-output continuation
+        // rather than the attempt's first turn, so the recovery bookkeeping (and
+        // its `recovered` event) does not apply to it.
+        const isContinuation = this.settleWaiters.length > 0;
+        const policy = (0, session_recovery_policy_1.effectiveSessionRecoveryPolicy)(this.config.sessionRecovery);
+        if (!isContinuation && policy && this.recoveryContinuation > 0 && this.sessionId) {
             this.emitRecovery('recovered', policy, this.recoveryContinuation, this.sessionId);
         }
         this.turnSettled = true;
         this._turnText.clear();
         this.clearTimers();
         this.emit('idle');
-        void this._cleanup();
+        this.settleContinuation();
+        // The handle is deliberately left alive: `agent()`'s declared-output guard
+        // continues the same session when the turn ended without the artifact, and
+        // it cannot do that against a torn-down client. Teardown is owned by
+        // `abort()`, which the agent node always calls in its `finally`.
+    }
+    settleContinuation() {
+        const waiters = this.settleWaiters;
+        if (waiters.length === 0)
+            return;
+        this.settleWaiters = [];
+        for (const waiter of waiters)
+            waiter.resolve();
+    }
+    rejectContinuation(error) {
+        const waiters = this.settleWaiters;
+        if (waiters.length === 0)
+            return;
+        this.settleWaiters = [];
+        for (const waiter of waiters)
+            waiter.reject(error);
     }
     handleModelCallFailure(sdkSession, e) {
         if (this._sdkSession !== sdkSession || this.aborted)
             return;
         if (this.logAgentScopedFailure(e))
             return;
-        const data = e.data;
+        // The payload may be the flat SDK shape or the CLI's nested envelope; see
+        // `normalizeModelCallFailure`. Everything below reads the normalized view.
+        const data = normalizeModelCallFailure(e.data);
         const detail = typeof data?.errorMessage === 'string'
             ? data.errorMessage
             : typeof data?.errorCode === 'string'
@@ -2377,6 +2548,7 @@ class SdkSession {
         this.activeCompactionEventId = undefined;
         this.turnSettled = true;
         this.clearTimers();
+        this.rejectContinuation(err);
         try {
             this.writeStderr('error', `[SdkBackend] ${eventType}: ${this.serializeEventDataCompact(eventType, data)}\n`);
         }
@@ -2446,7 +2618,7 @@ class SdkSession {
             if (!e.agentId && this.nativeRetryGraceTimer) {
                 clearTimeout(this.nativeRetryGraceTimer);
                 this.nativeRetryGraceTimer = null;
-                const policy = effectiveSessionRecoveryPolicy(this.config.sessionRecovery);
+                const policy = (0, session_recovery_policy_1.effectiveSessionRecoveryPolicy)(this.config.sessionRecovery);
                 if (policy && this.sessionId) {
                     this.emitRecovery('native-retry', policy, this.recoveryContinuation, this.sessionId);
                 }
@@ -2687,16 +2859,23 @@ class SdkSession {
                 inactivityMs,
                 lastProgressType: this.lastForwardProgressType,
             };
-            if (this.activeToolCalls.size > 0 || this.pendingExternalRequests.size > 0) {
-                this.fail(error, 'session.progress_timeout.pending_work', {
-                    ...data,
-                    activeToolCalls: this.activeToolCalls.size,
-                    pendingExternalRequests: this.pendingExternalRequests.size,
-                });
-                return;
-            }
-            const policy = effectiveSessionRecoveryPolicy(this.config.sessionRecovery);
+            // Resolve the policy before the in-flight test: a node that opted into
+            // recovery prefers the warm continuation over failing outright, even with
+            // a tool call outstanding. The resume does not replay that call, so a
+            // genuinely running subagent read is abandoned and re-issued by the model.
+            // For the read-only work recovery is opted into for, that is the right
+            // trade against failing the node; a mutating node opts out of recovery.
+            const policy = (0, session_recovery_policy_1.effectiveSessionRecoveryPolicy)(this.config.sessionRecovery);
+            const hasPendingWork = this.activeToolCalls.size > 0 || this.pendingExternalRequests.size > 0;
             if (!policy) {
+                if (hasPendingWork) {
+                    this.fail(error, 'session.progress_timeout.pending_work', {
+                        ...data,
+                        activeToolCalls: this.activeToolCalls.size,
+                        pendingExternalRequests: this.pendingExternalRequests.size,
+                    });
+                    return;
+                }
                 this.fail(error, 'session.progress_timeout', data);
                 return;
             }