opencrowd 0.15.2 → 0.15.4

package/bundle/opencrowd.js

@@ -15432,6 +15432,13 @@ var init_primitives = __esm({
 });
 
 // ../../packages/protocol/dist/outcomes.js
+function upstreamRefusalSummary(error53) {
+  const refusal = error53;
+  if (!refusal || typeof refusal !== "object" || refusal.name !== "HostedRequestError" || refusal.code !== "upstream_refused")
+    return void 0;
+  const detail = typeof refusal.message === "string" ? refusal.message.trim() : "";
+  return `The model provider refused this request before any payment, so nothing was charged${detail ? `: ${detail}` : "."} You can retry or send another message.`;
+}
 var RUN_FAILURE_MESSAGE, RUN_OUTCOMES, RunOutcomeSchema, RESUME_CAUSES, ResumeCauseSchema, RunStateSchema;
 var init_outcomes = __esm({
   "../../packages/protocol/dist/outcomes.js"() {
@@ -15926,7 +15933,7 @@ var init_limits = __esm({
 
 // ../../packages/protocol/dist/telemetry.js
 function scrubText(text) {
-  return text.replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/g, "[REDACTED]").replace(/\bBearer\s+[A-Za-z0-9._~+\/-]+=*/gi, "Bearer [REDACTED]").replace(/\b(?:sk-[A-Za-z0-9_-]{16,}|ph[csx]_[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)\b/g, "[REDACTED]").replace(/\b((?:[A-Z_]*(?:SECRET|PASSWORD|API_KEY|PRIVATE_KEY|ACCESS_TOKEN)[A-Z_]*|authorization|cookie|signature|x-amz-signature)\s*[=:]\s*)[^\s&,;]+/gi, "$1[REDACTED]").replace(/(https?:\/\/)[^\s/@]+:[^\s/@]+@/g, "$1[REDACTED]@");
+  return text.replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/g, "[REDACTED]").replace(/\bBearer\s+[A-Za-z0-9._~+\/-]+=*/gi, "Bearer [REDACTED]").replace(/\b(?:sk-[A-Za-z0-9_-]{16,}|ph[csx]_[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)\b/g, "[REDACTED]").replace(/\b((?:[A-Z_]*(?:SECRET|PASSWORD|API_KEY|PRIVATE_KEY|ACCESS_TOKEN)[A-Z_]*|authorization|cookie|signature|x-amz-signature)\s*[=:]\s*)[^\s&,;]+/gi, "$1[REDACTED]").replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+:[^\s/@]+@/gi, "$1[REDACTED]@");
 }
 function captureDetail(input2, maxBytes = 96 * 1024) {
   let redacted = false;
@@ -16101,6 +16108,18 @@ function estimateContextTokens(value) {
 function estimateModelInput(messages, tools) {
   return messages.reduce((total, message) => total + estimateContextTokens(message), estimateContextTokens(tools) + 32);
 }
+function isRequestTooLargeError(value, status) {
+  if (status === 413)
+    return true;
+  const error53 = value;
+  if (!error53 || typeof error53 !== "object")
+    return false;
+  if (["request_too_large", "payload_too_large", "request_entity_too_large", "body_too_large"].includes(String(error53.code)))
+    return true;
+  if (typeof error53.message === "string" && /request (?:body|entity|payload) (?:is )?too large|payload too large|request too large|body must be at most/i.test(error53.message))
+    return true;
+  return error53.error !== value && !!error53.error && isRequestTooLargeError(typeof error53.error === "string" ? { message: error53.error } : error53.error);
+}
 function isContextWindowError(value) {
   const error53 = value;
   if (!error53 || typeof error53 !== "object")
@@ -16111,16 +16130,19 @@ function isContextWindowError(value) {
     return true;
   return error53.error !== value && !!error53.error && isContextWindowError(typeof error53.error === "string" ? { message: error53.error } : error53.error);
 }
-var MODEL_REQUEST_MAX_BYTES, MODEL_MAX_MESSAGES, MODEL_GATEWAY_TIMEOUT_MS, MODEL_BRIDGE_TIMEOUT_MS, SERVICE_GATEWAY_TIMEOUT_MS, SERVICE_BRIDGE_TIMEOUT_MS, SERVICE_RESPONSE_MAX_BYTES, DEFAULT_CONTEXT_WINDOW, ContextWindowExceeded;
+var MODEL_REQUEST_MAX_BYTES, MODEL_SELLER_REQUEST_MAX_BYTES, MODEL_MAX_MESSAGES, MODEL_GATEWAY_TIMEOUT_MS, MODEL_BRIDGE_TIMEOUT_MS, SERVICE_GATEWAY_TIMEOUT_MS, SERVICE_BRIDGE_TIMEOUT_MS, HOSTED_TOOL_BRIDGE_TIMEOUT_MS, HOSTED_CONTROL_TOOL_TIMEOUT_MS, SERVICE_RESPONSE_MAX_BYTES, DEFAULT_CONTEXT_WINDOW, ContextWindowExceeded;
 var init_context = __esm({
   "../../packages/protocol/dist/context.js"() {
     "use strict";
     MODEL_REQUEST_MAX_BYTES = 16 * 1024 * 1024;
+    MODEL_SELLER_REQUEST_MAX_BYTES = 5 * 1024 * 1024;
     MODEL_MAX_MESSAGES = 1e3;
     MODEL_GATEWAY_TIMEOUT_MS = 42e4;
     MODEL_BRIDGE_TIMEOUT_MS = 2 * MODEL_GATEWAY_TIMEOUT_MS + 3e4;
     SERVICE_GATEWAY_TIMEOUT_MS = 33e4;
     SERVICE_BRIDGE_TIMEOUT_MS = MODEL_GATEWAY_TIMEOUT_MS + SERVICE_GATEWAY_TIMEOUT_MS + 3e4;
+    HOSTED_TOOL_BRIDGE_TIMEOUT_MS = 9e4;
+    HOSTED_CONTROL_TOOL_TIMEOUT_MS = 185e3;
     SERVICE_RESPONSE_MAX_BYTES = 34 * 1024 * 1024;
     DEFAULT_CONTEXT_WINDOW = 64e3;
     ContextWindowExceeded = class extends Error {
@@ -16129,6 +16151,44 @@ var init_context = __esm({
   }
 });
 
+// ../../packages/protocol/dist/deadlines.js
+function withDeadline(work, timeoutMs, stage) {
+  let timer;
+  const started = work();
+  started.catch(() => void 0);
+  const expiry = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => reject(new DeadlineExceeded(stage, timeoutMs)), timeoutMs);
+  });
+  return Promise.race([started, expiry]).finally(() => clearTimeout(timer));
+}
+function deadline(totalMs, now = Date.now) {
+  const expiresAt = now() + totalMs;
+  return {
+    /** Milliseconds left, never negative. */
+    remaining: () => Math.max(0, expiresAt - now()),
+    expired: () => now() >= expiresAt,
+    /** The smaller of what is left and one operation's own ceiling. */
+    slice: (operationMs) => Math.min(operationMs, Math.max(0, expiresAt - now()))
+  };
+}
+var DeadlineExceeded;
+var init_deadlines = __esm({
+  "../../packages/protocol/dist/deadlines.js"() {
+    "use strict";
+    DeadlineExceeded = class extends Error {
+      stage;
+      timeoutMs;
+      code = "deadline_exceeded";
+      constructor(stage, timeoutMs) {
+        super(`${stage} did not finish within ${Math.round(timeoutMs / 1e3)}s`);
+        this.stage = stage;
+        this.timeoutMs = timeoutMs;
+        this.name = "DeadlineExceeded";
+      }
+    };
+  }
+});
+
 // ../../packages/protocol/dist/spending.js
 function spendingDecision(input2) {
   const amount = BigInt(input2.amount), committed = BigInt(input2.queryCommitted);
@@ -16242,6 +16302,7 @@ var init_dist = __esm({
     init_seq();
     init_codec();
     init_context();
+    init_deadlines();
     init_spending();
     init_financial_state();
   }
@@ -57687,6 +57748,16 @@ var init_offers = __esm({
 });
 
 // ../../packages/economy/dist/discovery.js
+function bounded(work, timeoutMs, stage) {
+  return withDeadline(work, timeoutMs, stage).catch((error53) => ({ ok: false, error: error53.message }));
+}
+function originOf(url3) {
+  try {
+    return new URL(url3).origin;
+  } catch {
+    return url3;
+  }
+}
 function searchResults(raw) {
   const body = raw?.results?.results ? raw.results : raw?.data?.results ? raw.data : raw;
   return Array.isArray(body?.results) ? body.results : Array.isArray(body?.services) ? body.services : [];
@@ -57728,12 +57799,16 @@ function ranked(ranking, schema) {
     sources: ranking.sources
   };
 }
-var RANKED_NOTE, BaseServiceDiscovery;
+var PROBE_DEADLINE_MS, VERIFY_SWEEP_DEADLINE_MS, CATALOG_DEADLINE_MS, RANKED_NOTE, BaseServiceDiscovery;
 var init_discovery = __esm({
   "../../packages/economy/dist/discovery.js"() {
     "use strict";
     init_dist3();
+    init_dist();
     init_offers();
+    PROBE_DEADLINE_MS = 15e3;
+    VERIFY_SWEEP_DEADLINE_MS = 6e4;
+    CATALOG_DEADLINE_MS = 45e3;
     RANKED_NOTE = "Ranked by CrowdCode across Base, Solana and Tempo (AgentCash, Coinbase's x402 catalog, MPP catalog and CrowdCode reviews): quality first, then effective price on best_network (including about $0.03 to move USDC between your own networks when that network's balance is short), then your balance there. Prefer the highest-ranked service that fits the task, whatever its network. Each result's `networks` are the networks it can be paid on; between results that fit the task equally well, one you can pay from a balance you already hold beats one that needs a transfer first. transfer_needed means your balance on best_network is short: move USDC between your own networks first if you have a tool for that; otherwise say which network needs funds. New/unreviewed services are allowed. Inspect the chosen endpoint before paying.";
     BaseServiceDiscovery = class {
       searchApi;
@@ -57745,17 +57820,26 @@ var init_discovery = __esm({
         this.options = options;
         this.rails = options.rails ?? localRails(options.paymentNetwork);
       }
-      async inspect(input2) {
+      async inspect(input2, budgetMs = PROBE_DEADLINE_MS) {
         const key = `${input2.method ?? "POST"} ${input2.url}`;
         const cached3 = this.cache.get(key);
         if (input2.body === void 0 && cached3 && cached3.until > Date.now())
           return { ok: true, data: cached3.data };
-        const result = await checkEndpointSchema({
-          url: input2.url,
-          probe: true,
-          sampleInputBody: input2.body && typeof input2.body === "object" ? input2.body : void 0,
-          signal: AbortSignal.timeout(1e4)
-        });
+        if (budgetMs <= 0)
+          return { ok: false, error: "Endpoint inspection ran out of time before it started" };
+        let result;
+        try {
+          result = await withDeadline(() => checkEndpointSchema({
+            url: input2.url,
+            probe: true,
+            sampleInputBody: input2.body && typeof input2.body === "object" ? input2.body : void 0,
+            signal: AbortSignal.timeout(Math.min(1e4, budgetMs))
+          }), budgetMs, `probe of ${originOf(input2.url)}`);
+        } catch (error53) {
+          if (!(error53 instanceof DeadlineExceeded))
+            throw error53;
+          return { ok: false, error: `${originOf(input2.url)} did not answer the inspection probe within ${Math.round(budgetMs / 1e3)}s` };
+        }
         if (!result.found)
           return { ok: false, error: result.message ?? "Endpoint inspection failed" };
         const advisory = result.advisories.find((a) => a.method === (input2.method ?? "POST").toUpperCase());
@@ -57813,17 +57897,31 @@ var init_discovery = __esm({
         const reason = payableNetworks(offers, this.rails).includes(preferred) ? `your ${preferred} balance does not cover it` : `${preferred} is not offered`;
         return `Pays ${networkLabel(offer)}${offer.network_name === preferred ? "" : ` (${reason})`}. ${quote}`;
       }
-      /** Probe candidates in order and keep the first `limit` this payer can settle. */
-      async verified(candidates, limit) {
+      /**
+       * Probe candidates in order and keep the first `limit` this payer can
+       * settle, within one shared time budget.
+       *
+       * `incomplete` is true when the budget ran out with candidates left. The
+       * caller says so in the note: a short list of real, payable services is a
+       * usable answer, and far better than the nine-minute silence this sweep used
+       * to be capable of. Returning nothing at all would not be.
+       */
+      async verified(candidates, limit, budgetMs = VERIFY_SWEEP_DEADLINE_MS) {
         const services = [];
+        const budget = deadline(budgetMs);
+        let incomplete = false;
         for (let i = 0; i < candidates.length && services.length < limit; i += 4) {
+          if (budget.expired()) {
+            incomplete = true;
+            break;
+          }
           const batch = await Promise.all(candidates.slice(i, i + 4).map(async (c) => {
             try {
               const endpoint = c.endpoint ?? new URL(c.path, typeof c.origin === "string" ? c.origin : c.origin?.url).href;
               let method = c.method ?? "POST";
-              let inspection = await this.inspect({ url: endpoint, method });
+              let inspection = await this.inspect({ url: endpoint, method }, budget.slice(PROBE_DEADLINE_MS));
               if (!inspection.ok && !c.method)
-                inspection = await this.inspect({ url: endpoint, method: method = "GET" });
+                inspection = await this.inspect({ url: endpoint, method: method = "GET" }, budget.slice(PROBE_DEADLINE_MS));
               const schema = inspection.data;
               if (!inspection.ok || !schema?.payable)
                 return void 0;
@@ -57845,7 +57943,13 @@ var init_discovery = __esm({
           }));
           services.push(...batch.filter(Boolean));
         }
-        return services.slice(0, limit);
+        if (budget.expired() && services.length < limit)
+          incomplete = true;
+        return { services: services.slice(0, limit), incomplete };
+      }
+      /** What the model is told when the probe budget cut a candidate list short. */
+      partialNote(incomplete) {
+        return incomplete ? " Some candidates were still being probed when the search's time budget ran out, so this list is partial; search again or narrow the query if nothing here fits." : "";
       }
       /** The networks this payer settles, as CrowdCode names them. */
       networks() {
@@ -57861,38 +57965,48 @@ var init_discovery = __esm({
         const limit = Math.min(20, Math.max(1, options.limit ?? 8));
         const { rank, ...searchOptions } = options;
         const [result, balances] = await Promise.all([
-          this.searchApi(query, { ...searchOptions, limit: Math.min(50, limit * 3) }).catch((error53) => ({ ok: false, error: error53.message })),
-          rank && this.options.balances ? this.options.balances().catch(() => void 0) : Promise.resolve(void 0)
+          bounded(() => this.searchApi(query, { ...searchOptions, limit: Math.min(50, limit * 3) }), CATALOG_DEADLINE_MS, "AgentCash search"),
+          rank && this.options.balances ? withDeadline(() => this.options.balances(), CATALOG_DEADLINE_MS, "wallet balance read").catch(() => void 0) : Promise.resolve(void 0)
         ]);
         const candidates = result.ok ? searchResults(result.data) : [];
         if (rank) {
-          const ranking = await rank({
+          const ranking = await bounded(() => rank({
             query,
             networks: this.networks(),
             ...balances ? { balances } : {},
             candidates: candidates.map(agentCashCandidate).filter((candidate) => candidate !== void 0),
             limit: Math.min(25, limit * 2)
-          }).catch((error53) => ({ ok: false, error: error53.message }));
+          }), CATALOG_DEADLINE_MS, "CrowdCode ranking");
           const services = ranking.data?.services;
           if (ranking.ok && Array.isArray(services)) {
             const ordered = services.filter((service) => typeof service?.endpoint === "string").map((service) => ({ endpoint: service.endpoint, method: service.method ?? void 0, name: service.name, ranking: service }));
-            return { ok: true, data: { services: await this.verified(ordered, limit), note: RANKED_NOTE } };
+            const verified2 = await this.verified(ordered, limit);
+            return { ok: true, data: { services: verified2.services, note: `${RANKED_NOTE}${this.partialNote(verified2.incomplete)}` } };
           }
         }
         if (!result.ok)
           return result;
+        const verified = await this.verified(candidates, limit);
         return { ok: true, data: {
-          services: await this.verified(candidates, limit),
-          note: `AgentCash discovery${rank ? " (CrowdCode ranking unavailable)" : ""}, verified ${describeRails(this.rails)}. New/unreviewed services are allowed. Inspect the chosen endpoint before paying.`
+          services: verified.services,
+          note: `AgentCash discovery${rank ? " (CrowdCode ranking unavailable)" : ""}, verified ${describeRails(this.rails)}. New/unreviewed services are allowed. Inspect the chosen endpoint before paying.${this.partialNote(verified.incomplete)}`
         } };
       }
       async discoverEndpoints(origin) {
-        const result = await discoverOriginSchema({ target: origin, signal: AbortSignal.timeout(1e4) });
+        let result;
+        try {
+          result = await withDeadline(() => discoverOriginSchema({ target: origin, signal: AbortSignal.timeout(1e4) }), PROBE_DEADLINE_MS, `discovery of ${origin}`);
+        } catch (error53) {
+          if (!(error53 instanceof DeadlineExceeded))
+            throw error53;
+          return { ok: false, error: `${origin} did not answer its discovery document within ${Math.round(PROBE_DEADLINE_MS / 1e3)}s` };
+        }
         if (!result.found)
           return { ok: false, error: result.message ?? "Provider discovery failed" };
         const candidates = result.endpoints.filter((e6) => e6.protocols?.some((protocol) => protocol === "x402" || protocol === "mpp")).map((e6) => ({ ...e6, origin: result.origin }));
+        const verified = await this.verified(candidates, 50);
         return { ok: true, data: {
-          services: await this.verified(candidates, 50),
+          services: verified.services,
           guidance: result.guidance,
           reads: result.endpoints.filter((e6) => ["siwx", "unprotected"].includes(e6.authMode ?? "")),
           note: "Use read_service to poll job URLs. Do not buy the same generation twice."
@@ -58621,7 +58735,7 @@ function requestFor(endpoint, method, body) {
 function inspectionKey(endpoint, method) {
   return `${method} ${endpoint}`;
 }
-function originOf(endpoint) {
+function originOf2(endpoint) {
   try {
     return new URL(endpoint).origin;
   } catch {
@@ -59053,7 +59167,7 @@ var init_gateway = __esm({
         };
       }
       async resolveApproval(endpoint, method, quotedCostCents, evidence) {
-        const origin = originOf(endpoint);
+        const origin = originOf2(endpoint);
         const rules = await loadApprovalRules(this.options.approvalRulesPath);
         const rule = matchApprovalRule(rules, endpoint, origin);
         if (rule?.decision === "block") {
@@ -59108,9 +59222,9 @@ var init_gateway = __esm({
           return `quoted cost ${quotedCostCents}c exceeds the per-call cap ${caps.maxCostCents}c for ${endpoint}`;
         }
         if (caps.sessionMaxCents !== void 0) {
-          const spent = (await listPurchases(this.options.session)).filter((state) => originOf(state.record.endpoint) === originOf(endpoint)).reduce((total, state) => total + state.record.charged_cost_cents, 0);
+          const spent = (await listPurchases(this.options.session)).filter((state) => originOf2(state.record.endpoint) === originOf2(endpoint)).reduce((total, state) => total + state.record.charged_cost_cents, 0);
           if (spent + quotedCostCents > caps.sessionMaxCents) {
-            return `quoted cost would exceed the session cap ${caps.sessionMaxCents}c for ${originOf(endpoint)} (already ${spent}c)`;
+            return `quoted cost would exceed the session cap ${caps.sessionMaxCents}c for ${originOf2(endpoint)} (already ${spent}c)`;
           }
         }
         return void 0;
@@ -59644,7 +59758,7 @@ async function completeWithContext(session, messages, options) {
       options.state.retry = 0;
       return response;
     } catch (error53) {
-      const overflow = error53 instanceof ContextWindowExceeded || !options.hosted && isContextWindowError(error53);
+      const overflow = error53 instanceof ContextWindowExceeded || !options.hosted && (isContextWindowError(error53) || isRequestTooLargeError(error53));
       if (!overflow || (options.state.retry ?? 0) >= 2)
         throw error53;
       options.state.retry = (options.state.retry ?? 0) + 1;
@@ -59670,10 +59784,12 @@ async function compactContext(session, messages, options) {
   const count = (list2) => Math.ceil(list2.reduce((total, m) => total + measure(m).tokens, toolTokens) * scale);
   const tokensBefore = count(messages);
   const retry = options.state.retry ?? 0;
-  const trigger = Math.floor(limits.trigger * 0.5 ** retry);
-  const target = Math.min(limits.target, Math.floor(trigger * 0.5));
   const bytes = (list2) => list2.reduce((total, m) => total + measure(m).bytes, toolBytes);
-  const transportLimit = MODEL_REQUEST_MAX_BYTES - 64 * 1024;
+  const budget = options.maxRequestBytes ?? (options.hosted ? MODEL_SELLER_REQUEST_MAX_BYTES : MODEL_REQUEST_MAX_BYTES);
+  const byteCeiling = budget - 64 * 1024;
+  const trigger = retry ? Math.min(Math.floor(limits.trigger * 0.5 ** retry), Math.floor(tokensBefore * 0.5)) : limits.trigger;
+  const target = Math.min(limits.target, Math.floor(trigger * 0.5));
+  const transportLimit = retry ? Math.floor(Math.min(byteCeiling, bytes(messages) * 0.5)) : byteCeiling;
   if (tokensBefore <= trigger && bytes(messages) <= transportLimit && messages.length <= MODEL_MAX_MESSAGES && !retry)
     return { tokensBefore, tokensAfter: tokensBefore };
   const raw = messages.map((message) => JSON.stringify(message)).join("\n") + "\n";
@@ -59732,7 +59848,7 @@ async function compactContext(session, messages, options) {
       entry.message.content = await externalize(entry.message, entry.index);
   }
   const tokensAfter = count(current());
-  if (tokensAfter > trigger || bytes(current()) > transportLimit || list.length > MODEL_MAX_MESSAGES)
+  if (tokensAfter > Math.max(trigger, limits.trigger) || bytes(current()) > byteCeiling || list.length > MODEL_MAX_MESSAGES)
     throw new Error(`Context cannot fit after compaction: system instructions, tools and required references exceed the input budget. Original context: ${archivePath}`);
   messages.splice(0, messages.length, ...current());
   return { tokensBefore, tokensAfter, archivePath };
@@ -62532,9 +62648,9 @@ ${value.slice(-(scanLimit - prefixLength))}`;
           );
         }
         const pollUrl = this.absolute(submitData.poll_url);
-        const deadline = Date.now() + budgetMs;
+        const deadline2 = Date.now() + budgetMs;
         let lastStatus = submitData.status || "queued";
-        while (Date.now() < deadline) {
+        while (Date.now() < deadline2) {
           await sleep(intervalMs);
           const pollResp = await this.fetchWithTimeout(pollUrl, {
             method: "GET",
@@ -64270,7 +64386,7 @@ var init_chunk_GPMYUGHX = __esm({
 });
 
 // ../../node_modules/@x402/evm/dist/esm/chunk-X4BYNI7R.mjs
-async function signEip2612Permit(signer, tokenAddress, tokenName, tokenVersion, chainId, deadline, permittedAmount) {
+async function signEip2612Permit(signer, tokenAddress, tokenName, tokenVersion, chainId, deadline2, permittedAmount) {
   const owner = signer.address;
   const spender = getAddress(PERMIT2_ADDRESS);
   const nonce = await signer.readContract({
@@ -64291,7 +64407,7 @@ async function signEip2612Permit(signer, tokenAddress, tokenName, tokenVersion,
     spender,
     value: approvalAmount,
     nonce,
-    deadline: BigInt(deadline)
+    deadline: BigInt(deadline2)
   };
   const signature = await signer.signTypedData({
     domain: domain3,
@@ -64305,7 +64421,7 @@ async function signEip2612Permit(signer, tokenAddress, tokenName, tokenVersion,
     spender,
     amount: approvalAmount.toString(),
     nonce: nonce.toString(),
-    deadline,
+    deadline: deadline2,
     signature,
     version: "1"
   };
@@ -64432,7 +64548,7 @@ async function trySignEip2612PermitExtension(signer, options, requirements, resu
   } catch {
   }
   const permit2Auth = result.payload?.permit2Authorization;
-  const deadline = permit2Auth?.deadline ?? Math.floor(Date.now() / 1e3 + requirements.maxTimeoutSeconds).toString();
+  const deadline2 = permit2Auth?.deadline ?? Math.floor(Date.now() / 1e3 + requirements.maxTimeoutSeconds).toString();
   const info = await signEip2612Permit(
     {
       address: signer.address,
@@ -64443,7 +64559,7 @@ async function trySignEip2612PermitExtension(signer, options, requirements, resu
     tokenName,
     tokenVersion,
     chainId,
-    deadline,
+    deadline2,
     requiredAllowance
   );
   return {
@@ -64861,10 +64977,10 @@ async function createUptoPermit2Payload(signer, x402Version2, paymentRequirement
   const now = Math.floor(Date.now() / 1e3);
   const nonce = createPermit2Nonce();
   const validAfter = "0";
-  const deadline = (now + paymentRequirements.maxTimeoutSeconds).toString();
-  if (BigInt(deadline) <= BigInt(validAfter)) {
+  const deadline2 = (now + paymentRequirements.maxTimeoutSeconds).toString();
+  if (BigInt(deadline2) <= BigInt(validAfter)) {
     throw new Error(
-      `Invalid time window: deadline (${deadline}) must be after validAfter (${validAfter}). Check that maxTimeoutSeconds (${paymentRequirements.maxTimeoutSeconds}) is positive.`
+      `Invalid time window: deadline (${deadline2}) must be after validAfter (${validAfter}). Check that maxTimeoutSeconds (${paymentRequirements.maxTimeoutSeconds}) is positive.`
     );
   }
   const permit2Authorization = {
@@ -64875,7 +64991,7 @@ async function createUptoPermit2Payload(signer, x402Version2, paymentRequirement
     },
     spender: x402UptoPermit2ProxyAddress,
     nonce,
-    deadline,
+    deadline: deadline2,
     witness: {
       to: getAddress(paymentRequirements.payTo),
       facilitator: getAddress(facilitatorAddress),
@@ -87039,8 +87155,8 @@ function createHostedProvider(options) {
       if (!operationId?.startsWith(`${options.runId}:llm:`))
         throw new Error("Hosted model operation scope is missing");
       const body = JSON.stringify({ runId: options.runId, sessionId: options.sessionId, operationId, messages: messages.map(({ contextArchive: _archive, ...message }) => message), tools });
-      if (Buffer.byteLength(body) > MODEL_REQUEST_MAX_BYTES)
-        throw new Error("Hosted request exceeds the transport byte limit");
+      if (Buffer.byteLength(body) > MODEL_SELLER_REQUEST_MAX_BYTES)
+        throw new ContextWindowExceeded(`Hosted request is ${Buffer.byteLength(body)} bytes, above the ${MODEL_SELLER_REQUEST_MAX_BYTES} a seller accepts`);
       const result = await new Promise((resolve9, reject) => {
         const req = request({
           socketPath: options.socketPath,
@@ -87071,6 +87187,9 @@ function createHostedProvider(options) {
           });
         });
         req.setTimeout(MODEL_BRIDGE_TIMEOUT_MS, () => req.destroy(new Error("Hosted bridge timed out")));
+        const total = setTimeout(() => req.destroy(new Error("Hosted bridge exceeded its total deadline")), MODEL_BRIDGE_TIMEOUT_MS);
+        total.unref?.();
+        req.once("close", () => clearTimeout(total));
         req.on("error", reject);
         req.end(body);
       }).catch((error53) => {
@@ -87104,10 +87223,14 @@ function rejectedRequest(status, text) {
       return new HostedRequestError("model_failed", status, String(body.message ?? "The model response failed after payment settled. Its receipt is saved."));
     if (body.paid !== false)
       return void 0;
-    if (isContextWindowError({ code: body.error, message: body.message }))
+    const upstream = body.upstream && typeof body.upstream === "object" && typeof body.upstream.code === "string" ? { status: Number(body.upstream.status) || status, code: body.upstream.code } : void 0;
+    const refusal = { code: upstream?.code ?? body.error, message: body.message };
+    if (isContextWindowError(refusal))
       return new ContextWindowExceeded(String(body.message ?? "Provider context window exceeded"));
+    if (isRequestTooLargeError(refusal, upstream?.status ?? status))
+      return new ContextWindowExceeded(String(body.message ?? "The model provider refused this request as too large"));
     const code = typeof body.error === "string" && body.error ? body.error : `http_${status}`;
-    return new HostedRequestError(code, status, typeof body.message === "string" && body.message ? body.message : `The model request was rejected (${code})`);
+    return new HostedRequestError(code, status, typeof body.message === "string" && body.message ? body.message : `The model request was rejected (${code})`, upstream);
   } catch {
     return void 0;
   }
@@ -87159,8 +87282,11 @@ async function postHostedTool(options, name, args, settings = {}) {
         }
       });
     });
-    const timeoutMs = settings.timeoutMs ?? SERVICE_BRIDGE_TIMEOUT_MS;
+    const timeoutMs = settings.timeoutMs ?? HOSTED_TOOL_BRIDGE_TIMEOUT_MS;
     req.setTimeout(timeoutMs, () => req.destroy(new HostedToolTimeout(name, timeoutMs)));
+    const total = setTimeout(() => req.destroy(new HostedToolTimeout(name, timeoutMs)), timeoutMs);
+    total.unref?.();
+    req.once("close", () => clearTimeout(total));
     req.on("error", reject);
     req.end(body);
   });
@@ -87183,7 +87309,8 @@ function createHostedToolExecutor(options) {
       }
     }
     try {
-      const result = await postHostedTool(options, name, { ...args, ...source === void 0 ? {} : { source } }, { signal: context.signal });
+      const timeoutMs = ["deploy_service", "request_secret", "vault_request"].includes(name) ? HOSTED_CONTROL_TOOL_TIMEOUT_MS : void 0;
+      const result = await postHostedTool(options, name, { ...args, ...source === void 0 ? {} : { source } }, { signal: context.signal, ...timeoutMs ? { timeoutMs } : {} });
       if (result.ok)
         return { ok: true, data: await boundResponse(context.session, result.data) };
       return { ok: false, error: result.error ?? "tool failed" };
@@ -87207,12 +87334,18 @@ var init_hosted_provider = __esm({
     HostedRequestError = class extends Error {
       code;
       status;
-      constructor(code, status, message) {
+      upstream;
+      constructor(code, status, message, upstream) {
         super(message);
         this.code = code;
         this.status = status;
+        this.upstream = upstream;
         this.name = "HostedRequestError";
       }
+      /** What the owner reads as the run's summary; undefined keeps the generic copy. */
+      get summary() {
+        return upstreamRefusalSummary(this);
+      }
     };
     HOSTED_TOOL_REQUEST_BYTES = 1024 * 1024;
     HostedToolTimeout = class extends Error {
@@ -87348,7 +87481,7 @@ function numberValue6(value) {
   }
   return void 0;
 }
-var DEFAULT_CROWDCODE_BASE, LIST_CACHE_MS, FIND_TIMEOUT_MS, PAY_TIMEOUT_MS, RECONCILE_DELAY_MS, NOT_SENT_CODES, FREE_FETCH_TIMEOUT_MS, USDC_ATOMIC_PER_USD, TRANSFER_WAIT_MS, TRANSFER_POLL_MS, PREFERRED_MOVE_USD, MOVE_FEE_ALLOWANCE_USD, MOVE_FEE_ESTIMATE_USD, MAX_MOVE_FEE_SHARE, BASE_WORKING_RESERVE_USD, RAIL_NETWORK2, ServiceDirectory, HostedAgentCashAdapter, usd, isPending, HostedCrowdCodeAdapter, HOSTED_BRIDGE_TOOL;
+var DEFAULT_CROWDCODE_BASE, LIST_CACHE_MS, FIND_TIMEOUT_MS, DIRECTORY_TIMEOUT_MS, PAY_TIMEOUT_MS, RECONCILE_DELAY_MS, NOT_SENT_CODES, FREE_FETCH_TIMEOUT_MS, USDC_ATOMIC_PER_USD, TRANSFER_WAIT_MS, TRANSFER_POLL_MS, PREFERRED_MOVE_USD, MOVE_FEE_ALLOWANCE_USD, MOVE_FEE_ESTIMATE_USD, MAX_MOVE_FEE_SHARE, BASE_WORKING_RESERVE_USD, RAIL_NETWORK2, ServiceDirectory, HostedAgentCashAdapter, usd, isPending, HostedCrowdCodeAdapter, HOSTED_BRIDGE_TOOL;
 var init_hosted_economy = __esm({
   "../../packages/agent-runtime/dist/hosted-economy.js"() {
     "use strict";
@@ -87362,6 +87495,7 @@ var init_hosted_economy = __esm({
     DEFAULT_CROWDCODE_BASE = "https://crowdcode-backend.onrender.com";
     LIST_CACHE_MS = 6e4;
     FIND_TIMEOUT_MS = 2e4;
+    DIRECTORY_TIMEOUT_MS = 2e4;
     PAY_TIMEOUT_MS = SERVICE_GATEWAY_TIMEOUT_MS + 3e4;
     RECONCILE_DELAY_MS = 2e3;
     NOT_SENT_CODES = /* @__PURE__ */ new Set(["ENOENT", "ECONNREFUSED", "EACCES", "ENOTDIR"]);
@@ -87388,11 +87522,11 @@ var init_hosted_economy = __esm({
         if (!force && this.cache && Date.now() - this.cache.fetchedAt < LIST_CACHE_MS) {
           return this.cache.services;
         }
-        const response = await this.fetcher(`${this.base}/api/services`, { headers: { accept: "application/json" } });
+        const response = await withDeadline(() => this.fetcher(`${this.base}/api/services`, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(DIRECTORY_TIMEOUT_MS) }), DIRECTORY_TIMEOUT_MS, "CrowdCode service list");
         if (!response.ok) {
           throw new Error(`CrowdCode service list unavailable (HTTP ${response.status})`);
         }
-        const payload = await response.json();
+        const payload = await withDeadline(() => response.json(), DIRECTORY_TIMEOUT_MS, "CrowdCode service list body");
         const rows = Array.isArray(payload) ? payload : objectValue5(payload)?.services;
         const services = (Array.isArray(rows) ? rows : []).map(parseListedService).filter((row) => row !== void 0);
         for (const service of services) {
@@ -87412,8 +87546,8 @@ var init_hosted_economy = __esm({
         return this.idsByEndpoint.get(key);
       }
       async detail(serviceId) {
-        const response = await this.fetcher(`${this.base}/api/services/${encodeURIComponent(serviceId)}`, { headers: { accept: "application/json" } });
-        const body = objectValue5(await response.json().catch(() => void 0));
+        const response = await withDeadline(() => this.fetcher(`${this.base}/api/services/${encodeURIComponent(serviceId)}`, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(DIRECTORY_TIMEOUT_MS) }), DIRECTORY_TIMEOUT_MS, "CrowdCode service detail");
+        const body = objectValue5(await withDeadline(() => response.json(), DIRECTORY_TIMEOUT_MS, "CrowdCode service detail body").catch(() => void 0));
         return { status: response.status, body };
       }
     };
@@ -87558,7 +87692,7 @@ var init_hosted_economy = __esm({
           throw new SpendingDeclined();
         if (reply.code === "approval_required")
           throw new RuntimePause("waiting_for_approval", purchaseId, "Spending approval required. Review the quoted amount to continue.");
-        if (reply.code === "expected_payment_required") {
+        if (reply.code === "expected_payment_required" || reply.code === "upstream_refused") {
           return this.fetchUnpaid(request2.url, method, body, request2.headers);
         }
         if (reply.code === "funding_required") {
@@ -87594,13 +87728,13 @@ var init_hosted_economy = __esm({
       /** The supervisor found no 402: the endpoint is free, so the worker fetches it itself. */
       async fetchUnpaid(url3, method, body, headers) {
         try {
-          const response = await this.fetcher(url3, {
+          const response = await withDeadline(() => this.fetcher(url3, {
             method,
             signal: AbortSignal.timeout(FREE_FETCH_TIMEOUT_MS),
             headers: { accept: "application/json", ...body !== void 0 ? { "content-type": "application/json" } : {}, ...headers ?? {} },
             ...body !== void 0 && method !== "GET" ? { body } : {}
-          });
-          const text = await response.text();
+          }), FREE_FETCH_TIMEOUT_MS, "unpaid request");
+          const text = await withDeadline(() => response.text(), FREE_FETCH_TIMEOUT_MS, "unpaid response body");
           return {
             ok: response.status < 400,
             ambiguous: false,
@@ -87691,8 +87825,8 @@ var init_hosted_economy = __esm({
         if (!reply.ok)
           return { ok: false, error: describeTransferError(reply) };
         let transfer2 = objectValue5(objectValue5(reply.data)?.transfer) ?? {};
-        const deadline = Date.now() + this.transferWait.totalMs;
-        while (isPending(transfer2) && stringValue5(transfer2.id) && Date.now() < deadline) {
+        const deadline2 = Date.now() + this.transferWait.totalMs;
+        while (isPending(transfer2) && stringValue5(transfer2.id) && Date.now() < deadline2) {
           await new Promise((resolve9) => setTimeout(resolve9, this.transferWait.pollMs));
           const next = await postHostedTool(this.socket, "economy.transfer", { action: "status", transfer_id: transfer2.id }, { timeoutMs: 6e4 }).catch(() => void 0);
           if (next?.ok)
@@ -87723,13 +87857,13 @@ var init_hosted_economy = __esm({
       /** CrowdCode's cross-chain search and ranking over its public API. */
       async findServices(search) {
         try {
-          const response = await this.directory.fetcher(`${this.directory.base}/api/services/find`, {
+          const response = await withDeadline(() => this.directory.fetcher(`${this.directory.base}/api/services/find`, {
             method: "POST",
             signal: AbortSignal.timeout(FIND_TIMEOUT_MS),
             headers: { accept: "application/json", "content-type": "application/json" },
             body: JSON.stringify(search)
-          });
-          const body = objectValue5(await response.json().catch(() => void 0));
+          }), FIND_TIMEOUT_MS + 5e3, "CrowdCode ranking");
+          const body = objectValue5(await withDeadline(() => response.json(), FIND_TIMEOUT_MS, "CrowdCode ranking body").catch(() => void 0));
           return response.ok && body?.ok !== false ? { ok: true, data: body } : { ok: false, error: `CrowdCode search failed (HTTP ${response.status})` };
         } catch (error53) {
           return { ok: false, error: `CrowdCode search unavailable: ${error53.message}` };
@@ -87806,6 +87940,44 @@ var init_hosted_economy = __esm({
   }
 });
 
+// ../../packages/agent-runtime/dist/tool-deadlines.js
+function toolDeadlineMs(name, env = process.env) {
+  if (name === "run_shell")
+    return SHELL_TIMEOUT_CEILING_MS + 12e4;
+  void env;
+  return TOOL_DEADLINE_MS[name] ?? DEFAULT_TOOL_DEADLINE_MS;
+}
+function toolDeadlineError(name, timeoutMs) {
+  const seconds = Math.round(timeoutMs / 1e3);
+  if (name === "call_paid_service")
+    return `the paid call did not finish within ${seconds}s and its payment state is unknown. It was NOT retried and must not be retried automatically; check get_wallet_status and tell the owner the payment needs reconciling from the ledger.`;
+  return `${name} did not finish within ${seconds}s and was abandoned. Nothing was charged for it. Try a different approach, or the same one once more if it is likely to have been a transient stall.`;
+}
+var TOOL_DEADLINE_MS, DEFAULT_TOOL_DEADLINE_MS;
+var init_tool_deadlines = __esm({
+  "../../packages/agent-runtime/dist/tool-deadlines.js"() {
+    "use strict";
+    init_dist();
+    init_dist2();
+    TOOL_DEADLINE_MS = {
+      // Its own ceiling is PAY_TIMEOUT_MS (gateway + 30s) for the payment, plus
+      // inspection, the reputation check and one reconcile before that.
+      call_paid_service: SERVICE_BRIDGE_TIMEOUT_MS + 12e4,
+      // Catalogs, a ranking call and a bounded probe sweep.
+      find_paid_service: 18e4,
+      inspect_paid_service: 12e4,
+      read_service: 12e4,
+      review_paid_service: 12e4,
+      // Quote, sign, submit, then wait for the funds to land (TRANSFER_WAIT_MS).
+      bridge_usdc: 3e5,
+      deploy_service: HOSTED_CONTROL_TOOL_TIMEOUT_MS + 6e4,
+      request_secret: HOSTED_CONTROL_TOOL_TIMEOUT_MS + 6e4,
+      vault_request: HOSTED_CONTROL_TOOL_TIMEOUT_MS + 6e4
+    };
+    DEFAULT_TOOL_DEADLINE_MS = 12e4;
+  }
+});
+
 // ../../packages/agent-runtime/dist/worker.js
 import { readFile as readFile13, mkdir as mkdir11 } from "node:fs/promises";
 import { join as join21 } from "node:path";
@@ -87842,6 +88014,7 @@ var init_worker = __esm({
     init_dist();
     init_dist6();
     init_hosted_economy();
+    init_tool_deadlines();
     init_knowledge();
     MAX_WORKER_STATE_CHARS = 2 * 1024 * 1024;
     RuntimePause = class extends Error {
@@ -88109,7 +88282,7 @@ var init_worker = __esm({
             try {
               if (saved?.approvalPending && name === "call_paid_service" && economy)
                 await economy.execute("inspect_paid_service", { url: args.url, method: args.method, sample_body: args.body });
-              output3 = capToolResult(await invoke());
+              output3 = capToolResult(await this.withinDeadline(name, invoke));
               if (financialState && name === "get_budget_status")
                 output3 = { ok: true, data: latestFinancialState };
               if (financialState && name === "complete_session" && output3.ok && output3.data && typeof output3.data === "object")
@@ -88251,7 +88424,25 @@ var init_worker = __esm({
           } else if (error53 instanceof SpendingDeclined)
             await this.finish(runId, run, "user_stopped", error53.message);
           else
-            await this.finish(runId, run, "failed", RUN_FAILURE_MESSAGE);
+            await this.finish(runId, run, "failed", upstreamRefusalSummary(error53) ?? RUN_FAILURE_MESSAGE);
+        }
+      }
+      /**
+       * The backstop deadline around one tool call.
+       *
+       * A `RuntimePause` must still travel: an approval or a funding stop is the
+       * tool reporting a decision, not failing to answer. Everything else becomes
+       * an ordinary tool error, so the loop keeps the turn and the model chooses
+       * what to do instead of the owner losing the run.
+       */
+      async withinDeadline(name, invoke) {
+        const timeoutMs = (this.options.toolDeadlineMs ?? toolDeadlineMs)(name);
+        try {
+          return await withDeadline(invoke, timeoutMs, `tool ${name}`);
+        } catch (error53) {
+          if (!(error53 instanceof DeadlineExceeded))
+            throw error53;
+          return { ok: false, error: toolDeadlineError(name, timeoutMs) };
         }
       }
       /** Keep the bundled knowledge tree when it loads; a broken snapshot must never fail a hosted run. */
@@ -89466,6 +89657,7 @@ var init_dist6 = __esm({
     init_x402_proxy();
     init_knowledge();
     init_context2();
+    init_tool_deadlines();
     MockLlmProvider = class {
       random;
       endProbability;
@@ -90187,7 +90379,7 @@ function gradeTrajectory(entries) {
   for (const call2 of calls) {
     if (/_get_service_score$/.test(call2.name) || call2.name === "inspect_paid_service") {
       report.score_checks += 1;
-      const origin = originOf2(call2.arguments);
+      const origin = originOf3(call2.arguments);
       if (origin) {
         scoredOrigins.add(origin);
       }
@@ -90199,7 +90391,7 @@ function gradeTrajectory(entries) {
       report.fetch_calls += 1;
       if (hasPaymentEvidence(call2.result)) {
         report.paid_calls += 1;
-        const origin = originOf2(call2.arguments);
+        const origin = originOf3(call2.arguments);
         if (!origin || !scoredOrigins.has(origin)) {
           report.paid_before_score += 1;
         }
@@ -90270,7 +90462,7 @@ function searchKeys(value, pattern, depth) {
   }
   return false;
 }
-function originOf2(args) {
+function originOf3(args) {
   const candidate = args.url ?? args.api_endpoint ?? args.endpoint ?? args.origin ?? args.resource_url;
   if (typeof candidate !== "string") {
     return void 0;
@@ -91575,7 +91767,7 @@ function flattenService(detail) {
     service_id: serviceId,
     name: String(service.name ?? ""),
     endpoint,
-    origin: originOf3(endpoint),
+    origin: originOf4(endpoint),
     payment_provider: String(service.payment_provider ?? "unknown"),
     score: Number(detail.score ?? 0),
     n_eff: Number(detail.n_eff ?? 0),
@@ -91621,7 +91813,7 @@ async function fetchWithRetry(fetchImpl, url3) {
   }
   return void 0;
 }
-function originOf3(endpoint) {
+function originOf4(endpoint) {
   try {
     return new URL(endpoint).origin;
   } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencrowd",
-  "version": "0.15.2",
+  "version": "0.15.4",
   "description": "A CLI agent with its own wallet — discovers x402 services, pays in USDC, and completes tasks under a local budget",
   "type": "module",
   "license": "MIT",