maka-agent 0.2.0-dev.53.20260927 → 0.2.0-dev.62.20260928

package/node_modules/@maka/eval/harbor/egress_filter.py

@@ -23,7 +23,10 @@ import json
 import os
 import re
 import time
+from contextlib import suppress
+from ipaddress import IPv6Address
 from pathlib import Path
+from typing import NamedTuple
 from urllib.parse import unquote, urlsplit
 
 PINNED_REVISION = "d49e28f1e4ddd13d289e85a5f312a66750951932"
@@ -36,6 +39,14 @@ PERCENT_ESCAPE = re.compile(r"%(?![0-9a-fA-F]{2})")
 TERMINAL_BENCH = re.compile(r"terminal[-_.%/+\s]*bench", re.IGNORECASE)
 
 
+class ConnectTarget(NamedTuple):
+    """Validated CONNECT authority adapted into the URL policy's input shape."""
+
+    host: str
+    port: int | None
+    url: str
+
+
 def contamination_rule(raw_url: str) -> tuple[str, str, str] | None:
     normalized = normalize_url(raw_url)
     url = urlsplit(normalized)
@@ -150,12 +161,12 @@ def configure(updated: object) -> None:
 
 
 def request(flow: object) -> None:
-    apply_http_policy(flow, flow.request.pretty_url)
+    enforce_url_policy(flow, flow.request.pretty_url)
 
 
 def response(flow: object) -> None:
-    response = getattr(flow, "response", None)
-    if getattr(response, "status_code", None) != 101:
+    reply = getattr(flow, "response", None)
+    if getattr(reply, "status_code", None) != 101:
         return
     # mitmproxy 12.2.3 sets flow.websocket before HttpResponseHook only when
     # the 101 is a real WebSocket upgrade (Upgrade + version 13 + option on).
@@ -163,36 +174,34 @@ def response(flow: object) -> None:
     # under rawtcp=false and must be audited.
     if getattr(flow, "websocket", None) is not None:
         return
-    record_raw_tunnel(flow)
+    reject_raw_transport(flow, close=False)
 
 
 def http_connect(flow: object) -> None:
+    request = getattr(flow, "request", None)
     try:
-        raw_url = connect_target_url(flow)
-    except Exception:
-        raw_url = ""
-    apply_http_policy(flow, raw_url)
+        target = parse_connect_target(
+            getattr(request, "host", None),
+            getattr(request, "port", None),
+        ).url
+    except (TypeError, ValueError):
+        target = ""
+    enforce_url_policy(flow, target)
 
 
 def tcp_start(flow: object) -> None:
-    # Last resort if a TCPLayer is still admitted (tcp_hosts / ignore).
-    # CONNECT raw is closed by next_layer → CloseRawLayer; HTTP 101 raw is
-    # closed by rawtcp=false. Neither of those paths starts a TCPLayer.
-    record_raw_tunnel(flow)
-    kill_flow(flow)
+    # This is a last-resort hook for a raw layer admitted by an override.
+    reject_raw_transport(flow)
 
 
 def tcp_message(flow: object) -> None:
     messages = getattr(flow, "messages", None)
-    if messages:
+    if messages and hasattr(messages[-1], "content"):
         messages[-1].content = b""
-    kill_flow(flow)
+    close_flow(flow)
 
 
 def next_layer(nextlayer: object) -> None:
-    # Script addons run before the built-in classifier assigns layer. If we
-    # set CloseRawLayer here, NextLayer leaves it in place. Waiting for
-    # isinstance(..., TCPLayer) never fires on the production CONNECT path.
     current = getattr(nextlayer, "layer", None)
     context = getattr(nextlayer, "context", None)
     if current is None:
@@ -204,20 +213,20 @@ def next_layer(nextlayer: object) -> None:
             server_tls.child_layer = ClientTLSLayer(context)
             nextlayer.layer = server_tls
             return
-        if not looks_like_raw_tcp(nextlayer):
+        if not initial_stream_is_raw(nextlayer):
             return
-        record_raw_tunnel(context)
-        nextlayer.layer = CloseRawLayer(context)
+        reject_raw_transport(context, close=False)
+        nextlayer.layer = RejectRawTransport(context, proxy_commands)
         return
     if TCPLayer is None or not isinstance(current, TCPLayer):
         return
-    record_raw_tunnel(context)
-    closer = CloseRawLayer(context)
+    reject_raw_transport(context, close=False)
+    closer = RejectRawTransport(context, proxy_commands)
     replace_layer(context, current, closer)
     nextlayer.layer = closer
 
 
-def apply_http_policy(flow: object, raw_url: str) -> None:
+def enforce_url_policy(flow: object, raw_url: str) -> None:
     if http is None:
         raise RuntimeError("mitmproxy is required to run the Eval egress filter")
     try:
@@ -225,7 +234,7 @@ def apply_http_policy(flow: object, raw_url: str) -> None:
         if not matched:
             return
         rule_id, host, normalized_path = matched
-        append_audit(rule_id, host, normalized_path)
+        audit_event(rule_id, host, normalized_path)
         flow.response = blocked_response(rule_id)
     except Exception as error:
         flow.response = http.Response.make(
@@ -237,27 +246,50 @@ def apply_http_policy(flow: object, raw_url: str) -> None:
             },
         )
         try:
-            append_audit("policy_error", "", type(error).__name__)
+            audit_event("policy_error", "", type(error).__name__)
         except Exception:
             pass
 
 
-def connect_target_url(flow: object) -> str:
-    request = flow.request
-    host = (getattr(request, "pretty_host", None) or getattr(request, "host", "") or "").strip()
-    if not host:
-        raise ValueError("empty CONNECT host")
-    if ":" in host and not host.startswith("["):
-        host = f"[{host}]"
-    port = getattr(request, "port", None)
-    if port in (None, 443):
-        return f"https://{host}/"
-    if port == 80:
-        return f"http://{host}/"
-    return f"https://{host}:{port}/"
+def connect_url(host: object, port: object) -> str:
+    return parse_connect_target(host, port).url
 
 
-def looks_like_raw_tcp(nextlayer: object) -> bool:
+def parse_connect_target(host: object, port: object) -> ConnectTarget:
+    normalized_host = _normalize_connect_host(host)
+    normalized_port = _normalize_connect_port(port)
+    scheme = "http" if normalized_port == 80 else "https"
+    authority = normalized_host if normalized_port in (None, 443, 80) else f"{normalized_host}:{normalized_port}"
+    return ConnectTarget(
+        host=normalized_host,
+        port=normalized_port,
+        url=f"{scheme}://{authority}/",
+    )
+
+
+def _normalize_connect_host(host: object) -> str:
+    if not isinstance(host, str) or not host or host != host.strip():
+        raise ValueError("empty CONNECT host")
+    if host.startswith("[") and host.endswith("]"):
+        IPv6Address(host[1:-1])
+        return host
+    if ":" in host:
+        IPv6Address(host)
+        return f"[{host}]"
+    if re.search(r"[\s/@?#\\\[\]]", host):
+        raise ValueError("invalid CONNECT host")
+    return host
+
+
+def _normalize_connect_port(port: object) -> int | None:
+    if port is None:
+        return None
+    if type(port) is not int or not 1 <= port <= 65535:
+        raise ValueError("invalid CONNECT port")
+    return port
+
+
+def initial_stream_is_raw(nextlayer: object) -> bool:
     """Close only when the bytes cannot still become HTTP or TLS.
 
     Script next_layer runs before mitmproxy 12.2.3's classifier. Copying its
@@ -309,9 +341,9 @@ def _next_layer_bytes(nextlayer: object, name: str) -> bytes:
     return bytes(data) if isinstance(data, (bytes, bytearray)) else b""
 
 
-def tcp_peer(flow: object) -> tuple[str, str]:
-    server = getattr(flow, "server_conn", None) or getattr(flow, "server", None)
-    address = getattr(server, "address", None) if server is not None else None
+def peer_label(owner: object) -> tuple[str, str]:
+    server = getattr(owner, "server_conn", None) or getattr(owner, "server", None)
+    address = getattr(server, "address", None)
     if isinstance(address, (tuple, list)) and address:
         host = str(address[0])[:255]
         port = address[1] if len(address) > 1 else ""
@@ -319,19 +351,21 @@ def tcp_peer(flow: object) -> tuple[str, str]:
     return "", ""
 
 
-def record_raw_tunnel(flow: object) -> None:
-    host, path = tcp_peer(flow)
+def reject_raw_transport(owner: object, *, close: bool = True) -> None:
+    host, port = peer_label(owner)
     try:
-        append_audit("raw_tunnel", host, path)
+        audit_event("raw_tunnel", host, port)
     except Exception:
         pass
+    if close:
+        close_flow(owner)
 
 
-def kill_flow(flow: object) -> None:
-    kill = getattr(flow, "kill", None)
-    if callable(kill) and getattr(flow, "killable", True):
+def close_flow(flow: object) -> None:
+    terminate = getattr(flow, "kill", None)
+    if callable(terminate) and getattr(flow, "killable", True):
         try:
-            kill()
+            terminate()
         except Exception:
             pass
 
@@ -351,8 +385,9 @@ def replace_layer(context: object, current: object, closer: object) -> None:
     layers.insert(min(index, len(layers)), closer)
 
 
-class CloseRawLayer(Layer):
-    def __init__(self, context: object) -> None:
+class RejectRawTransport(Layer):
+    def __init__(self, context: object, commands: object) -> None:
+        self._close_connection = getattr(commands, "CloseConnection", None)
         if Layer is object:
             self.context = context
             return
@@ -363,13 +398,13 @@ class CloseRawLayer(Layer):
         super().__init__(context)
 
     def handle_event(self, event: object):
-        if proxy_commands is None:
+        if self._close_connection is None:
             return
             yield
         for name in ("client", "server"):
             connection = getattr(self.context, name, None)
             if connection is not None:
-                yield proxy_commands.CloseConnection(connection)
+                yield self._close_connection(connection)
 
 
 def blocked_response(rule_id: str):
@@ -383,53 +418,67 @@ def blocked_response(rule_id: str):
     )
 
 
-def append_audit(rule_id: str, host: str, normalized_path: str) -> None:
-    AUDIT_PATH.parent.mkdir(parents=True, exist_ok=True)
-    if AUDIT_PATH.exists() and AUDIT_PATH.stat().st_size >= MAX_AUDIT_BYTES:
-        write_truncation_marker()
-        return
-    record = {
-        "ts": int(time.time() * 1000),
-        "ruleId": rule_id,
-        "host": host[:255],
-        "normalizedPath": normalized_path[:4096],
-    }
-    with AUDIT_PATH.open("a", encoding="utf-8") as stream:
-        stream.write(json.dumps(record, ensure_ascii=True, separators=(",", ":")) + "\n")
-
-
-def write_truncation_marker() -> None:
-    if audit_already_truncated():
-        return
-    record = {
-        "ts": int(time.time() * 1000),
-        "ruleId": "audit_truncated",
-        "host": "",
-        "normalizedPath": "",
-    }
-    prefix = ""
-    if AUDIT_PATH.exists() and AUDIT_PATH.stat().st_size > 0:
-        with AUDIT_PATH.open("rb") as stream:
-            stream.seek(-1, os.SEEK_END)
-            if stream.read(1) != b"\n":
-                prefix = "\n"
-    with AUDIT_PATH.open("a", encoding="utf-8") as stream:
-        stream.write(prefix + json.dumps(record, ensure_ascii=True, separators=(",", ":")) + "\n")
-
-
-def audit_already_truncated() -> bool:
-    if not AUDIT_PATH.exists():
-        return False
-    with AUDIT_PATH.open("rb") as stream:
-        stream.seek(0, os.SEEK_END)
-        size = stream.tell()
-        stream.seek(max(0, size - 4096))
-        tail = stream.read().decode("utf-8", errors="ignore")
-    lines = [line for line in tail.splitlines() if line.strip()]
-    if not lines:
-        return False
-    try:
-        parsed = json.loads(lines[-1])
-    except json.JSONDecodeError:
-        return False
-    return isinstance(parsed, dict) and parsed.get("ruleId") == "audit_truncated"
+class AuditJournal:
+    def __init__(self, path: Path, byte_limit: int) -> None:
+        self.path = path
+        self.byte_limit = byte_limit
+
+    def record(self, rule_id: str, host: str, normalized_path: str) -> None:
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        entry = self._encode(rule_id, host[:255], normalized_path[:4096])
+        existing_bytes = self.path.stat().st_size if self.path.exists() else 0
+        if existing_bytes + len(entry) <= self.byte_limit:
+            with self.path.open("ab") as stream:
+                stream.write(entry)
+            return
+        self.mark_full()
+
+    def mark_full(self) -> None:
+        if self.has_full_marker():
+            return
+        with self.path.open("ab") as stream:
+            stream.write(self._separator() + self._encode("audit_truncated", "", ""))
+
+    def has_full_marker(self) -> bool:
+        last = self._last_record()
+        return last is not None and last.get("ruleId") == "audit_truncated"
+
+    def _separator(self) -> bytes:
+        if not self.path.exists() or self.path.stat().st_size == 0:
+            return b""
+        final_offset = self.path.stat().st_size - 1
+        with self.path.open("rb") as stream:
+            stream.seek(final_offset)
+            return b"" if stream.read(1) == b"\n" else b"\n"
+
+    def _last_record(self) -> dict[str, object] | None:
+        if not self.path.exists() or self.path.stat().st_size == 0:
+            return None
+        size = self.path.stat().st_size
+        with self.path.open("rb") as stream:
+            stream.seek(max(0, size - 4096))
+            lines = stream.read().decode("utf-8", errors="ignore").splitlines()
+        for line in reversed(lines):
+            if not line.strip():
+                continue
+            decoded = None
+            with suppress(json.JSONDecodeError):
+                decoded = json.loads(line)
+            return decoded if isinstance(decoded, dict) else None
+        return None
+
+    @staticmethod
+    def _encode(rule_id: str, host: str, normalized_path: str) -> bytes:
+        record = {
+            "ts": int(time.time() * 1000),
+            "ruleId": rule_id,
+            "host": host,
+            "normalizedPath": normalized_path,
+        }
+        return (json.dumps(record, ensure_ascii=True, separators=(",", ":")) + "\n").encode(
+            "utf-8"
+        )
+
+
+def audit_event(rule_id: str, host: str, normalized_path: str) -> None:
+    AuditJournal(AUDIT_PATH, MAX_AUDIT_BYTES).record(rule_id, host, normalized_path)

package/node_modules/@maka/eval/harbor/eval_framework.py

@@ -15,26 +15,49 @@
 # specific language governing permissions and limitations
 # under the License.
 
-"""Authoritative Eval harness framework selection.
-
-`run_trial.py` validates the argv framework and installs it here before Harbor,
-Pier, or the shared relay can import. The relay must not read the environment.
-"""
+"""Process-local framework authority shared by the trial runner and relay."""
 
 from __future__ import annotations
 
-_FRAMEWORKS = frozenset({"harbor", "pier"})
-_framework: str | None = None
+from typing import NamedTuple
+
+
+class FrameworkSpec(NamedTuple):
+    name: str
+    distribution: str
+    agent_module: str
 
 
-def install(framework: str) -> None:
-    if framework not in _FRAMEWORKS:
+_FRAMEWORKS = {
+    "harbor": FrameworkSpec("harbor", "harbor", "harbor.agents.base"),
+    "pier": FrameworkSpec("pier", "datacurve-pier", "pier.agents.base"),
+}
+_active: FrameworkSpec | None = None
+
+
+def framework_spec(name: str) -> FrameworkSpec:
+    try:
+        return _FRAMEWORKS[name]
+    except KeyError:
         raise RuntimeError("framework must be harbor or pier")
-    global _framework
-    _framework = framework
 
 
-def selected() -> str:
-    if _framework not in _FRAMEWORKS:
+def install(name: str) -> None:
+    """Select the framework before importing its process-wide relay module."""
+
+    global _active
+    _active = framework_spec(name)
+
+
+def current_framework() -> str:
+    if _active is None:
         raise RuntimeError("Eval framework selection is not installed")
-    return _framework
+    return _active.name
+
+
+def framework_distribution(name: str) -> str:
+    return framework_spec(name).distribution
+
+
+def framework_agent_module(name: str) -> str:
+    return framework_spec(name).agent_module

package/node_modules/@maka/eval/harbor/relay_agent.py

@@ -23,6 +23,7 @@ import asyncio
 import base64
 import contextlib
 import hashlib
+import importlib
 import json
 import os
 import re
@@ -31,13 +32,10 @@ import tempfile
 from pathlib import Path
 from typing import Any
 
-from eval_framework import selected
+from eval_framework import current_framework, framework_agent_module
 
-framework = selected()
-if framework == "harbor":
-    from harbor.agents.base import BaseAgent
-else:
-    from pier.agents.base import BaseAgent
+framework = current_framework()
+BaseAgent = importlib.import_module(framework_agent_module(framework)).BaseAgent
 
 
 class RelayTransportClosed(RuntimeError):

package/node_modules/@maka/eval/harbor/run_trial.py

@@ -120,7 +120,13 @@ async def run_trial(framework: str, expected_version: str, config_file: Path) ->
     from eval_framework import install
 
     install(framework)
-    distribution = {"harbor": "harbor", "pier": "datacurve-pier"}[framework]
+    await _run_selected_trial(framework, expected_version, config_file)
+
+
+async def _run_selected_trial(framework: str, expected_version: str, config_file: Path) -> None:
+    from eval_framework import framework_distribution
+
+    distribution = framework_distribution(framework)
     if importlib.metadata.version(distribution) != expected_version:
         raise FrameworkVersionMismatch
     try:
@@ -184,10 +190,11 @@ async def create_harbor_trial(trial_type: type, config: object) -> object:
 
 
 async def main() -> None:
-    from eval_framework import install
-
     framework, expected_version, config_path = sys.argv[1:]
-    install(framework)
+    await _run_main(framework, expected_version, config_path)
+
+
+async def _run_main(framework: str, expected_version: str, config_path: str) -> None:
     task = asyncio.current_task()
     assert task is not None
     loop = asyncio.get_running_loop()

package/node_modules/@maka/runtime/dist/agent-graph-supervisor-wake.js

@@ -217,7 +217,9 @@ export class AgentGraphSupervisorWakeCoordinator {
                 snapshotVersion: snapshot.snapshotVersion,
                 rootSessionId,
             });
-            if (this.#closed || claimed.wake.status === 'delivered')
+            if (this.#closed ||
+                claimed.wake.status === 'delivered' ||
+                claimed.wake.status === 'exhausted')
                 return;
             abortSignal.throwIfAborted();
             await this.#deliverWake(claimed.wake, snapshot, abortSignal, result);
@@ -279,6 +281,14 @@ export class AgentGraphSupervisorWakeCoordinator {
         await this.#deliverWake(wake, snapshot, abortSignal);
     }
     async #deliverWake(wake, snapshot, abortSignal, result) {
+        if (wake.status === 'exhausted')
+            return;
+        if (wake.attemptCount >= this.#maxDeliveryAttempts) {
+            if (wake.status === 'retryable_failed') {
+                await this.#input.wakeStore.exhaustAgentGraphSupervisorWake(wake.graphId, wake.wakeId, wake.failureReason?.slice(0, 4_000) || 'delivery_attempts_exhausted');
+            }
+            return;
+        }
         const presentation = (await this.#input.renderWake?.(wake.rootSessionId, snapshot, result)) ?? {
             text: renderAgentGraphSupervisorWakePrompt(snapshot, result),
             displayText: 'Agent graph reached a supervisor checkpoint.',
@@ -286,7 +296,7 @@ export class AgentGraphSupervisorWakeCoordinator {
         };
         let lastFailure;
         let overflowRecoveryAttempted = false;
-        for (let index = 0; index < this.#maxDeliveryAttempts; index += 1) {
+        for (let index = wake.attemptCount; index < this.#maxDeliveryAttempts; index += 1) {
             abortSignal.throwIfAborted();
             if (!(await this.#isSessionDeliverable(wake.rootSessionId))) {
                 await this.#supersedeSession(wake.rootSessionId, 'session_unavailable');
@@ -304,9 +314,15 @@ export class AgentGraphSupervisorWakeCoordinator {
                     wakeId: wake.wakeId,
                     attemptId,
                     turnId,
+                    maxAttempts: this.#maxDeliveryAttempts,
                 });
-                if (!admission.acquired)
+                if (!admission.acquired) {
+                    if (admission.wake.status === 'retryable_failed' &&
+                        admission.wake.attemptCount >= this.#maxDeliveryAttempts) {
+                        await this.#input.wakeStore.exhaustAgentGraphSupervisorWake(wake.graphId, wake.wakeId, admission.wake.failureReason?.slice(0, 4_000) || 'delivery_attempts_exhausted');
+                    }
                     return;
+                }
                 if (this.#sessionWakesSuppressed(wake.rootSessionId))
                     return;
                 if (this.#closed) {
@@ -396,7 +412,8 @@ export class AgentGraphSupervisorWakeCoordinator {
                         recoveryAttempted: overflowRecoveryAttempted,
                     });
                     await emitWakeDiagnostic(this.#input.onDiagnostic, exhaustedDiagnostic(wake, overflowError));
-                    throw overflowError;
+                    await this.#input.wakeStore.exhaustAgentGraphSupervisorWake(wake.graphId, wake.wakeId, overflowError.message.slice(0, 4_000));
+                    return;
                 }
                 overflowRecoveryAttempted = true;
                 try {
@@ -413,6 +430,15 @@ export class AgentGraphSupervisorWakeCoordinator {
                         attemptId: overflowAttempt.attemptId,
                         ...(recovery ? { recovery } : {}),
                     });
+                    if (recovery?.outcome && recovery.outcome.kind !== 'compacted') {
+                        const overflowError = await this.#contextOverflowError(wake.rootSessionId, snapshot, {
+                            recoveryAttempted: true,
+                            recoveryFailure: recovery.outcome.reason,
+                        });
+                        await emitWakeDiagnostic(this.#input.onDiagnostic, exhaustedDiagnostic(wake, overflowError));
+                        await this.#input.wakeStore.exhaustAgentGraphSupervisorWake(wake.graphId, wake.wakeId, overflowError.message.slice(0, 4_000));
+                        return;
+                    }
                 }
                 catch (error) {
                     if (this.#closed || isAbortError(error))
@@ -430,13 +456,14 @@ export class AgentGraphSupervisorWakeCoordinator {
                         recoveryFailure: failureReason,
                     });
                     await emitWakeDiagnostic(this.#input.onDiagnostic, exhaustedDiagnostic(wake, overflowError));
-                    throw overflowError;
+                    await this.#input.wakeStore.exhaustAgentGraphSupervisorWake(wake.graphId, wake.wakeId, overflowError.message.slice(0, 4_000));
+                    return;
                 }
             }
             if (this.#closed)
                 return;
         }
-        throw new Error(`Agent graph supervisor wake was not delivered after ${this.#maxDeliveryAttempts} attempts: ${lastFailure ?? 'unknown failure'}`);
+        await this.#input.wakeStore.exhaustAgentGraphSupervisorWake(wake.graphId, wake.wakeId, lastFailure?.slice(0, 4_000) || 'delivery_attempts_exhausted');
     }
     async #contextOverflowError(rootSessionId, fallbackSnapshot, input) {
         let currentSnapshot = fallbackSnapshot;

package/node_modules/@maka/runtime/dist/ai-sdk-turn.js

@@ -20,7 +20,7 @@ import { DEFAULT_TOOL_MODE, isToolMode } from '@maka/core/tool-mode';
 import { resolveEffectiveOrchestration, } from '@maka/core/orchestration';
 import { stripUndefinedDeep } from '@maka/core/tool-args-identity';
 import { YIELD_AGENT_GRAPH_TOOL_NAME, } from './stream-graph-supervisor-tools.js';
-import { providerRetryReason } from './provider-error-classification.js';
+import { providerRetryReason } from './provider-retry-policy.js';
 import Ajv from 'ajv';
 import Ajv2019 from 'ajv/dist/2019.js';
 import Ajv2020 from 'ajv/dist/2020.js';

package/node_modules/@maka/runtime/dist/plugin-executor-backend.js

@@ -51,19 +51,39 @@ export class PluginExecutorBackend {
         const queue = new AsyncEventQueue();
         const messageId = this.#newId();
         const producer = this.#produce(input, messageId, abort.signal, queue).finally(() => queue.close());
-        const active = { abort, settled: producer };
+        const active = { abort, settled: producer.then(() => undefined) };
         this.#active.add(active);
+        let acknowledged = false;
         try {
             for await (const event of queue) {
                 yield event;
                 queue.ackConsumed();
             }
-            await producer;
+            const returnedResult = await producer;
+            if (returnedResult) {
+                // The Runtime Kernel requests the next item only after onSessionEvent
+                // resolves. Reaching this point means its terminal event was accepted.
+                // The Plugin decides whether its external execution actually settled;
+                // uncertain execution or a failed checkpoint keeps the pending marker.
+                if (this.#binding.acknowledgeExecution)
+                    try {
+                        await this.#binding.acknowledgeExecution(this.sessionId, input.turnId);
+                        acknowledged = true;
+                    }
+                    catch {
+                        /* The provider abandonment below makes the uncertainty explicit. */
+                    }
+            }
         }
         finally {
             queue.noteConsumerDetached();
             abort.abort(new Error('Plugin executor event consumer detached'));
-            await producer.catch(() => undefined);
+            const returnedResult = await producer.catch(() => false);
+            if (returnedResult &&
+                this.#binding.acknowledgeExecution &&
+                !acknowledged &&
+                this.#binding.abandonExecution)
+                await this.#binding.abandonExecution(this.sessionId, input.turnId).catch(() => undefined);
             this.#active.delete(active);
         }
     }
@@ -128,13 +148,14 @@ export class PluginExecutorBackend {
                 this.#publishCancellation(turnId, { status: 'cancelled', source: 'caller' }, queue);
             else
                 this.#publishFailure(turnId, failure instanceof Error ? failure.message : 'External executor failed', undefined, false, queue);
-            return;
+            return false;
         }
         if (result === undefined) {
             this.#publishFailure(turnId, 'External executor returned no terminal result', undefined, false, queue);
-            return;
+            return false;
         }
         this.#publishResult(turnId, messageId, result, queue);
+        return true;
     }
     async #requestPermission(input, request, signal, toolUseIds, queue) {
         const hosted = input.hostedInteraction;