dreadnode 2.0.46__tar.gz → 2.0.47__tar.gz

{dreadnode-2.0.46 → dreadnode-2.0.47}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: dreadnode
-Version: 2.0.46
+Version: 2.0.47
 Summary: Dreadnode SDK
 Project-URL: Homepage, https://dreadnode.io
 Project-URL: Documentation, https://docs.dreadnode.io
@@ -52,7 +52,7 @@ Requires-Dist: textual>=8.0.2
 Requires-Dist: transformers>=4.57.1
 Requires-Dist: truststore<1.0.0,>=0.10.4
 Requires-Dist: uvicorn>=0.34.0
-Requires-Dist: websockets>=14.0
+Requires-Dist: websockets>=15.0.1
 Requires-Dist: xmltodict>=1.0.2
 Provides-Extra: airt-ml
 Requires-Dist: scikit-learn<2.0.0,>=1.7.1; extra == 'airt-ml'

{dreadnode-2.0.46 → dreadnode-2.0.47}/dreadnode/airt/assessment.py

@@ -246,28 +246,17 @@ class Assessment:
             return None
 
         try:
-            # Get runtime_id - try to use a default runtime for the project
-            runtime_id = getattr(self, "_runtime_id", None)
-            if runtime_id is None:
-                # Auto-discover a runtime for this project (CLI users shouldn't need to specify this)
-                try:
-                    runtimes_resp = api.list_runtimes(profile.org_key, profile.workspace_key)
-                    runtime_items = runtimes_resp.get("items", [])
-                    matching_runtimes = [r for r in runtime_items if r["project_id"] == project_id]
-                    if matching_runtimes:
-                        runtime_id = matching_runtimes[0]["id"]
-                        logger.debug(f"Auto-selected runtime {runtime_id} for project {project_id}")
-                    else:
-                        logger.warning(f"No runtimes found for project {project_id}")
-                except Exception as e:
-                    logger.debug(f"Failed to auto-discover runtime for project: {e}")
-
+            # A null runtime id asks the server to pick the caller's own runtime
+            # for the project. Members each hold their own runtimes there, so a
+            # client has no way to know which one is meant; anything inferred
+            # here would be a guess sent as though the caller had chosen it.
+            # Pass through what the caller supplied, nothing more.
             result = api.create_airt_assessment(
                 profile.org_key,
                 profile.workspace_key,
                 name=self.name,
                 project_id=project_id,
-                runtime_id=runtime_id,
+                runtime_id=self._runtime_id,
                 description=self.description,
                 session_id=self._session_id,
                 target_model=self.target_model,

{dreadnode-2.0.46 → dreadnode-2.0.47}/dreadnode/app/api/models.py

@@ -103,6 +103,9 @@ class PlatformConfig(BaseModel):
     credits_enabled: bool = True
     feedback_enabled: bool = False
     integrations_enabled: bool = True
+    # Whether the operator has switched on the Agent Policies pages. Absent
+    # (False) on older platforms.
+    agent_policies_enabled: bool = False
     # Whether the operator has enabled the Slack integration for this
     # deployment. Absent (False) on older platforms, which have no Slack routes
     # at all, so a client that does not receive it shows nothing (SLK-GATE-003).

{dreadnode-2.0.46 → dreadnode-2.0.47}/dreadnode/app/cli/airt.py

@@ -405,7 +405,9 @@ def create(
     ] = None,
     runtime_id: t.Annotated[
         str | None,
-        cyclopts.Parameter(help="Runtime ID. Required when the project has multiple runtimes."),
+        cyclopts.Parameter(
+            help="Runtime ID. Defaults to your own runtime in the project; a runtime you don't own is ignored."
+        ),
     ] = None,
     description: t.Annotated[str | None, cyclopts.Parameter(help="Assessment description")] = None,
     session_id: t.Annotated[str | None, cyclopts.Parameter(help="Session ID to associate")] = None,

{dreadnode-2.0.46 → dreadnode-2.0.47}/dreadnode/app/cli/args.py

@@ -244,7 +244,7 @@ class TuiArgs(PlatformScopeArgs):
         int | None,
         cyclopts.Parameter(
             group=TUI_GROUP,
-            help="Step budget for autonomous mode (defaults to 30)",
+            help="Step budget for autonomous mode (defaults to 100)",
         ),
     ] = None
     policy: t.Annotated[

{dreadnode-2.0.46 → dreadnode-2.0.47}/dreadnode/app/cli/main.py

@@ -18,6 +18,7 @@ from rich.panel import Panel
 
 from dreadnode.app.cli.args import RESUME_PICK_SENTINEL, PlatformArgs, TuiArgs
 from dreadnode.app.cli.shared import console, print_error, print_success
+from dreadnode.app.config import DEFAULT_AUTONOMOUS_MAX_STEPS
 from dreadnode.app.model_catalog import resolve_model
 from dreadnode.core.tls import format_tls_error
 
@@ -255,6 +256,17 @@ def _default(*, tui_args: TuiArgs = TuiArgs()) -> None:
 # ---------------------------------------------------------------------------
 
 
+def _autonomous_step_budget(tui_args: TuiArgs) -> int:
+    """Step budget for unattended runs (``--auto``, ``--print``).
+
+    ``--max-steps`` wins when supplied; otherwise these surfaces run under the
+    product default rather than the budget-neutral ``headless`` policy default.
+    """
+    if tui_args.max_steps is not None:
+        return tui_args.max_steps
+    return DEFAULT_AUTONOMOUS_MAX_STEPS
+
+
 def create_app(tui_args: TuiArgs) -> "DreadnodeTextualApp":
     """Build a :class:`DreadnodeTextualApp` from resolved CLI/TUI args.
 
@@ -297,9 +309,10 @@ def create_app(tui_args: TuiArgs) -> "DreadnodeTextualApp":
         if tui_args.max_steps is not None and "max_steps" not in initial_policy:
             initial_policy["max_steps"] = tui_args.max_steps
     elif tui_args.auto:
-        initial_policy = {"name": "headless"}
-        if tui_args.max_steps is not None:
-            initial_policy["max_steps"] = tui_args.max_steps
+        initial_policy = {
+            "name": "headless",
+            "max_steps": _autonomous_step_budget(tui_args),
+        }
 
     return DreadnodeTextualApp(
         profile=profile,
@@ -359,6 +372,7 @@ def _run_print(tui_args: TuiArgs) -> None:
             capabilities=tui_args.capabilities,
             capability_flags=tui_args.capability_flags,
             system_prompt=tui_args.system_prompt,
+            max_steps=_autonomous_step_budget(tui_args),
             server_url=tui_args.runtime_server,
             platform_url=tui_args.server,
             project_memory_preload_limit=tui_args.project_memory_preload_limit,

{dreadnode-2.0.46 → dreadnode-2.0.47}/dreadnode/app/cli/runtime.py

@@ -104,6 +104,51 @@ def _field_value(item: t.Any, key: str) -> t.Any:
     return getattr(item, key, None)
 
 
+def _select_own_project_runtime(
+    items: t.Sequence[dict[str, t.Any]],
+    project_key: t.Any,
+) -> dict[str, t.Any] | None:
+    """Pick the runtime in a project that this caller may start, if any.
+
+    Each member holds their own runtimes in a project, so "the project's runtime" is not
+    something a client can look up; only "mine here" is. Returns ``None`` when
+    the caller holds none, which the caller reads as "ensure one".
+
+    Ownership is judged from the flag the server computes, not from having
+    asked for an owner-filtered listing: the filter travels as a query
+    parameter, and a server that does not recognise it answers with everything
+    rather than an error. A row that does not say it is mine is not selected.
+
+    That check is what makes the owner filter more than a request, but it is
+    not a guarantee on its own. A server old enough to omit the flag also
+    predates owner-scoped runtime keys, so the ensure path this returns ``None``
+    into can still hand back whichever runtime holds the project's key. Against
+    such a server there is no answer to "which of these is mine" to be had, in
+    this function or anywhere else.
+
+    Among the caller's own, a running runtime wins, then a paused one, then the
+    one keyed to the project, then the newest. That is the runtime selection
+    rule in specs/runtimes.md, which the platform resolver and the web chat
+    apply too, so starting a project here lands on the runtime an evaluation or
+    a chat session on it would use. Selection never depends on the order rows
+    arrive in. A caller who wants a different runtime passes ``--runtime-id``.
+    """
+    owned = [item for item in items if item.get("owned_by_me") is True]
+    if not owned:
+        return None
+    status_rank = {"running": 2, "paused": 1}
+    keyed = isinstance(project_key, str) and bool(project_key)
+    return max(
+        owned,
+        key=lambda item: (
+            status_rank.get(str(item.get("status")), 0),
+            keyed and item.get("key") == project_key,
+            str(item.get("created_at") or ""),
+            str(item.get("id") or ""),
+        ),
+    )
+
+
 def _resolve_secret_ids(api: t.Any, selectors: list[str]) -> list[str] | None:
     if not selectors:
         return None
@@ -599,18 +644,32 @@ def start(
         "description",
     )
     runtime_target = runtime_id
+    unowned_runtime_probe = False
     if runtime_target is None and target:
-        # The platform resolves a runtime key or UUID on this path, so probe it
-        # as a runtime first and fall back to treating <target> as a project.
-        # Previously this was gated on the target looking like a UUID, which
-        # meant a runtime key only ever started by accident — via the project
-        # branch below, and only when the project happened to share its name.
+        # <target> is ambiguous by design: a runtime key, a runtime UUID, or a
+        # project. The platform resolves runtime keys and UUIDs on this path, so
+        # probe it as a runtime first and read it as a project otherwise.
+        #
+        # A runtime the caller is known not to own does not settle the
+        # ambiguity. Runtime keys resolve across the workspace, and the first
+        # member to get a runtime in a project takes the project's own key for
+        # it — so the plain `dn runtime start <project>` that works for that
+        # member probes straight onto their runtime for everyone else. Reading
+        # the name as a project instead finds the caller's own runtime there.
+        #
+        # Only an explicit denial redirects. A server that says nothing about
+        # ownership has not said no, and the caller did name this runtime, so it
+        # is started as asked — unlike picking one for them out of a listing,
+        # where silence is a reason not to choose.
         try:
-            api.get_runtime(profile.org_key, profile.workspace_key, target)
+            probed = api.get_runtime(profile.org_key, profile.workspace_key, target)
         except NotFoundError:
             runtime_target = None
         else:
-            runtime_target = target
+            if _field_value(probed, "owned_by_me") is False:
+                unowned_runtime_probe = True
+            else:
+                runtime_target = target
 
     if runtime_target is not None:
         payload = api.start_runtime(
@@ -656,7 +715,18 @@ def start(
             raise ValueError(
                 "Pass a runtime id or project, or set --project in your platform scope."
             )
-        project = api.get_project(profile.org_key, profile.workspace_key, resolved_project)
+        try:
+            project = api.get_project(profile.org_key, profile.workspace_key, resolved_project)
+        except NotFoundError:
+            if unowned_runtime_probe:
+                # The name matched a runtime, just not one this caller can
+                # operate, and it names no project either. Reporting a missing
+                # project would send them looking for the wrong thing.
+                raise ValueError(
+                    f"'{resolved_project}' is a runtime owned by someone else, and is not a "
+                    f"project. Run `dn runtime list --mine` to see the runtimes you can start."
+                ) from None
+            raise
         project_id = _field_value(project, "id")
         if not isinstance(project_id, str) or not project_id:
             raise ValueError(f"Project '{resolved_project}' did not include an id")
@@ -664,22 +734,26 @@ def start(
             profile.org_key,
             profile.workspace_key,
             project_id=project_id,
+            owner="me",
             limit=100,
         )
-        items = runtimes_payload.get("items", [])
-        if len(items) == 0:
+        selected = _select_own_project_runtime(
+            runtimes_payload.get("items", []),
+            _field_value(project, "key"),
+        )
+        if selected is None:
             created = api.create_runtime(
                 profile.org_key,
                 profile.workspace_key,
                 resolved_project,
             )
             runtime_to_start = t.cast("str", created["id"])
-        elif len(items) == 1:
-            runtime_to_start = t.cast("str", items[0]["id"])
         else:
-            raise ValueError(
-                "Project has multiple runtimes. Pass --runtime-id or ensure a specific runtime with --key/--name."
-            )
+            runtime_to_start = t.cast("str", selected["id"])
+            if selected.get("status") == "paused":
+                # Start hands back a paused sandbox as it is. Waking it is its
+                # own call; start then issues the credential for it.
+                api.resume_runtime(profile.org_key, profile.workspace_key, runtime_to_start)
 
     payload = api.start_runtime(
         profile.org_key,

{dreadnode-2.0.46 → dreadnode-2.0.47}/dreadnode/app/cli/workflow.py

@@ -191,6 +191,7 @@ def run(
     project_id: str,
     input: t.Annotated[list[str] | None, cyclopts.Parameter(name="--input", negative=())] = None,
     local: t.Annotated[bool, cyclopts.Parameter(name="--local", negative=())] = False,
+    model: str | None = None,
     runtime_id: str | None = None,
     runtime_url: str | None = None,
     as_json: t.Annotated[bool, cyclopts.Parameter(name="--json", negative=())] = False,
@@ -205,10 +206,16 @@ def run(
             when possible, so `max_steps=200` is an int.
         local: Execute here, in this process, shipping facts to the platform as
             it goes. Without it the selected runtime executes the workflow.
+        model: Default model for agents using inherit. Requires --local;
+            pinned agent models and explicit step models take precedence.
         runtime_id: Runtime that owns remote execution. Required unless `--local`.
         runtime_url: Runtime to run agents against when using `--local`.
         as_json: Output as JSON.
     """
+    if model is not None and not local:
+        raise ValueError("--model currently requires --local")
+    if model is not None and (not model.strip() or model.strip() == "inherit"):
+        raise ValueError("--model must be a concrete model ID")
     api, profile = platform.connect()
     try:
         input_data = parse_inputs(input)
@@ -261,6 +268,7 @@ def run(
         definition=definition,
         input_data=input_data,
         runtime_url=runtime_url,
+        model=model,
         session_group_id=created.get("session_group_id"),
         execution_id=execution_id,
     )
@@ -285,6 +293,7 @@ def _execute_locally(
     runtime_url: str | None,
     execution_id: str,
     session_group_id: str | None = None,
+    model: str | None = None,
 ) -> t.Any:
     """Run the workflow in this process, streaming progress and shipping facts.
 
@@ -310,6 +319,7 @@ def _execute_locally(
         capability=definition.get("capability_name"),
         run_id=str(run_id),
         session_group_id=str(session_group_id) if session_group_id else None,
+        default_model=model,
     )
 
     console.print(

{dreadnode-2.0.46 → dreadnode-2.0.47}/dreadnode/app/config.py

@@ -19,6 +19,10 @@ DEFAULT_CONFIG_PATH = Path.home() / ".dreadnode" / "config.yaml"
 # Default platform URL when no profile or override is set
 DEFAULT_PLATFORM_URL = "https://app.dreadnode.io"
 
+# Product safety budget for unattended CLI and TUI workflows. Session policies
+# remain budget-neutral unless a caller supplies this value explicitly.
+DEFAULT_AUTONOMOUS_MAX_STEPS = 100
+
 # Hostnames that are equivalent for URL comparison
 _LOCALHOST_ALIASES = frozenset({"localhost", "127.0.0.1", "::1"})
 

dreadnode-2.0.47/dreadnode/app/diagnostics.py

@@ -0,0 +1,53 @@
+"""Credential redaction shared by runtime diagnostics and bug reports."""
+
+import re
+
+_REDACTED = "[REDACTED]"
+_SECRET_ASSIGNMENT_RE = re.compile(
+    r"""(?ix)
+    (?P<prefix>
+        (?:
+            ["']?\b
+            (?:[a-z0-9]+[_-])*
+            (?:authorization|proxy-authorization|x-api-key|api[_-]?key|
+               access[_-]?token|refresh[_-]?token|id[_-]?token|password|
+               passwd|client[_-]?secret|secret|[a-z0-9]+[_-](?:token|key))
+            \b["']?\s*[=:]\s*
+            |
+            # Bare key/token labels also occur in prose. Require assignment or quoting.
+            (?:["']\b(?:token|key)["']\s*[=:]\s*|
+               \b(?:token|key)\s*(?:=\s*|:\s*(?=["'])))
+        )
+    )
+    (?:
+        (?P<double_quote>") (?:\\.|[^"\\\r\n])* "
+        |
+        (?P<single_quote>') (?:\\.|[^'\\\r\n])* '
+        |
+        (?:Bearer\s+)?[^\s,;}\]"']+
+    )
+    """
+)
+_BEARER_RE = re.compile(r"(?i)\bBearer\s+[A-Za-z0-9._~+/=-]+")
+_KNOWN_TOKEN_RE = re.compile(
+    r"\b(?:sk-[A-Za-z0-9_-]{12,}|dn_[A-Za-z0-9_-]{12,}|"
+    r"ghp_[A-Za-z0-9]{12,}|github_pat_[A-Za-z0-9_]{12,}|"
+    r"xox[baprs]-[A-Za-z0-9-]{12,})\b"
+)
+# Match through the last @ in the authority, without consuming the path/query/fragment.
+_URL_CREDENTIAL_RE = re.compile(r"""(?i)(\b[a-z][a-z0-9+.-]*://[^\s/:@'"<>]*:)([^\s/?#'"<>]+)(@)""")
+
+
+def redact_sensitive_text(value: str) -> str:
+    """Redact common credentials without dumping or inspecting environment state."""
+
+    def redact_assignment(match: re.Match[str]) -> str:
+        quote = match.group("double_quote") or match.group("single_quote") or ""
+        return f"{match.group('prefix')}{quote}{_REDACTED}{quote}"
+
+    value = _SECRET_ASSIGNMENT_RE.sub(redact_assignment, value)
+    value = _BEARER_RE.sub(f"Bearer {_REDACTED}", value)
+    value = _KNOWN_TOKEN_RE.sub(_REDACTED, value)
+    return _URL_CREDENTIAL_RE.sub(
+        lambda match: f"{match.group(1)}{_REDACTED}{match.group(3)}", value
+    )

{dreadnode-2.0.46 → dreadnode-2.0.47}/dreadnode/app/print_mode.py

@@ -9,6 +9,7 @@ from loguru import logger
 
 from dreadnode.app.client.managed_client import ManagedRuntimeClient
 from dreadnode.app.client.runtime_client import DEFAULT_MODEL
+from dreadnode.app.config import DEFAULT_AUTONOMOUS_MAX_STEPS
 from dreadnode.app.tui import wire_events as we
 from dreadnode.app.tui.wire_events import parse_wire_event
 
@@ -26,11 +27,12 @@ async def run_print_mode(
     capabilities: list[str] | None = None,
     capability_flags: list[str] | None = None,
     system_prompt: str | None = None,
+    max_steps: int = DEFAULT_AUTONOMOUS_MAX_STEPS,
     server_url: str | None = None,
     platform_url: str | None = None,
     project_memory_preload_limit: int = 20,
 ) -> None:
-    """Run a single prompt headlessly: stream response text to stdout, progress to stderr.
+    """Run one prompt headlessly with an explicit autonomous step budget.
 
     ``profile`` is the caller's already-resolved profile — the CLI passes the
     one built from ``--profile`` plus the scope flags and ``DREADNODE_*`` env
@@ -84,7 +86,7 @@ async def run_print_mode(
     session = await client.create_session(
         agent=agent,
         model=model,
-        policy="headless",
+        policy={"name": "headless", "max_steps": max_steps},
         project_memory_preload_limit=project_memory_preload_limit,
     )
     session_id = session.session_id

{dreadnode-2.0.46 → dreadnode-2.0.47}/dreadnode/app/server/app.py

@@ -209,6 +209,7 @@ def _make_agent_link_tool(
     extra_tools: list[t.Any] | None,
     extra_hooks: list[t.Any] | None,
     kind: str,
+    runtime_registry: t.Callable[[], capability_manager.CapabilityRegistry | None] | None = None,
 ) -> t.Any:
     """Create a synthetic tool that delegates work to another capability agent."""
     from dreadnode.agents.tools import Tool
@@ -221,6 +222,7 @@ def _make_agent_link_tool(
             extra_tools=extra_tools,
             extra_hooks=extra_hooks,
             system_prompt_append=get_state().system_prompt_append,
+            runtime_registry=runtime_registry,
         )
         return await delegated_agent.chat(task)
 
@@ -419,6 +421,7 @@ def create_agent(
     system_prompt_append: str | None = None,
     engine: str | None = None,
     background_context: str | None = None,
+    runtime_registry: t.Callable[[], capability_manager.CapabilityRegistry | None] | None = None,
 ) -> Agent:
     """Create an agent from a loaded capability.
 
@@ -433,6 +436,8 @@ def create_agent(
     rules since hooks aren't agent-scoped.
     """
     from dreadnode.agents import Agent
+    from dreadnode.agents.tools import Tool
+    from dreadnode.app.server.runtime_inspection import RuntimeInspection
     from dreadnode.capabilities.tool_rules import filter_tools
     from dreadnode.tools import default_tools
 
@@ -472,13 +477,6 @@ def create_agent(
     if tooling_health:
         instructions = instructions + "\n" + tooling_health
 
-    # Append CLI --system-prompt content as the final layer
-    if system_prompt_append:
-        instructions = instructions + "\n\n" + system_prompt_append
-
-    if background_context:
-        instructions = instructions + "\n\n" + background_context
-
     # 1. Inherent tools — always present. Item mutation tools are capability
     # opt-in and added below only when the manifest selects output types.
     base = default_tools(additional_toolsets=inherent_toolsets, include_items=False)
@@ -486,6 +484,15 @@ def create_agent(
     pool: list[t.Any] = list(base.values())
     pool_names = set(base.keys())
 
+    inspection = RuntimeInspection(
+        registry=runtime_registry or (lambda: get_state().capability_registry),
+        agent=lambda: agent,
+        capability=(capability.name, capability.version or "") if capability else None,
+    )
+    inspection_tool = Tool.from_callable(inspection.runtime_info)
+    pool.append(inspection_tool)
+    pool_names.add(inspection_tool.name)
+
     # Bundled @dreadnode gets the CLI helper, but it is not a global inherent tool.
     if (
         capability is not None
@@ -532,6 +539,7 @@ def create_agent(
                 extra_tools=extra_tools,
                 extra_hooks=extra_hooks,
                 kind=link.kind,
+                runtime_registry=runtime_registry,
             )
             name = _tool_name(tool)
             if name and name not in pool_names:
@@ -586,6 +594,15 @@ def create_agent(
     # 3. Apply agent's tool rules (empty dict = all tools pass)
     rules = agent_def.tools if agent_def else {}
     tools = filter_tools(pool, rules, name_fn=_tool_name)
+    if inspection_tool in tools:
+        instructions += "\n\n" + inspection.to_prompt()
+
+    # Keep caller-provided content after all host guidance.
+    if system_prompt_append:
+        instructions = instructions + "\n\n" + system_prompt_append
+
+    if background_context:
+        instructions = instructions + "\n\n" + background_context
 
     # Engine (loop owner): explicit override > agent_def declaration > native.
     # ``inherit``/empty falls through to the native engine (``None``).
@@ -2602,6 +2619,7 @@ class SessionRuntime:
             # ``None`` falls through to agent_def.engine then native.
             engine=self._engine,
             background_context=self._project_memory_background_context,
+            runtime_registry=lambda: self._registry,
         )
 
         self._wire_server_tools(agent)
@@ -3383,6 +3401,11 @@ class SessionRuntime:
                 # this helper is constructed and consumed within a single turn.
                 await request.stream.publish(event)  # noqa: B023
 
+            # Set when the failure below was reported by the agent itself on
+            # its terminal ``AgentEnd`` (already delivered to raw-event
+            # consumers) rather than raised by the runtime.
+            agent_reported_error = False
+
             try:
                 if request.model and request.model != self.model:
                     self.model = request.model
@@ -3527,7 +3550,7 @@ class SessionRuntime:
                 self.persistence.begin_turn()
                 # Local import to match the existing lazy-import style in
                 # this module and avoid eager event-module import at startup.
-                from dreadnode.agents.events import GenerationStep
+                from dreadnode.agents.events import AgentEnd, GenerationStep
 
                 try:
                     # Workflow attribution rides on the agent's own spans rather
@@ -3603,6 +3626,15 @@ class SessionRuntime:
                                 if isinstance(event, GenerationStep):
                                     flush_task = asyncio.create_task(self._persist_state_locked())
                                     self.persistence.track_flush_task(flush_task)
+                                # Engines report terminal errors on AgentEnd rather
+                                # than raising. Route them through the failed-turn
+                                # handler so terminal-envelope consumers see
+                                # turn.failed instead of an empty turn.completed.
+                                if isinstance(event, AgentEnd) and event.error is not None:
+                                    agent_reported_error = True
+                                    if isinstance(event.error, Exception):
+                                        raise event.error
+                                    raise RuntimeError(str(event.error))
                 finally:
                     reset_human_prompt_handler(token)
 
@@ -3723,12 +3755,17 @@ class SessionRuntime:
                 except Exception:
                     logger.opt(exception=True).debug("error-path persist raised")
 
-                error_event: EventPayload = {"type": "error", "error": str(exc)}
-                await _emit_turn_event(error_event)
-                await self._publish_broker_raw_event(
-                    turn_id=request.turn_id,
-                    raw_event=error_event,
-                )
+                # Raw-event consumers (TUI, eval worker, SSE chat) render the
+                # ``error`` event as a failure line. When the agent reported
+                # the error on its own AgentEnd they already have that line;
+                # emitting another would show the same error twice.
+                if not agent_reported_error:
+                    error_event: EventPayload = {"type": "error", "error": str(exc)}
+                    await _emit_turn_event(error_event)
+                    await self._publish_broker_raw_event(
+                        turn_id=request.turn_id,
+                        raw_event=error_event,
+                    )
                 turn_events = _turn_slice()
                 await self._publish_broker_event(
                     kind=runtime_events.EVENT_TURN_FAILED,