muse-code-sdk 1.3.1__tar.gz → 1.4.4__tar.gz

{muse_code_sdk-1.3.1/src/muse_code_sdk.egg-info → muse_code_sdk-1.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: muse-code-sdk
-Version: 1.3.1
+Version: 1.4.4
 Summary: Muse Code SDK for MSP: asyncio-first facade over the generated wire types (muse-code-msp), with a thin sync wrapper.
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/meta-models/muse-code-sdk

{muse_code_sdk-1.3.1 → muse_code_sdk-1.4.4}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "muse-code-sdk"
-version = "1.3.1"
+version = "1.4.4"
 description = "Muse Code SDK for MSP: asyncio-first facade over the generated wire types (muse-code-msp), with a thin sync wrapper."
 readme = "README.md"
 requires-python = ">=3.10"

{muse_code_sdk-1.3.1 → muse_code_sdk-1.4.4}/src/muse_code/__init__.py

@@ -47,6 +47,7 @@ __all__ = [
     "MuseForeignSessionError",
     "MuseGapFillError",
     "MuseHostDiedError",
+    "MuseHostStartError",
     "MuseSessionDiscardedError",
     "PendingCommandSet",
     "PendingCommandView",
@@ -77,7 +78,7 @@ __all__ = [
 ]
 
 EXPECTED_SCHEMA_FINGERPRINT: Final[str] = (
-    "sha256:b1e6676d624e116e2c1b150fec3192200d2cbca8ed79898e44f8921759c7872f"
+    "sha256:7c94f153c41659cb3f1bd3c3e04438be254644cb2a97d65d48edc7449b74858a"
 )
 """The stable schema-bundle fingerprint this SDK was built against.
 
@@ -89,7 +90,7 @@ Python SDK reds this lane instead of drifting silently.
 # The lockstep rule: the release train bumps pyproject.toml, the
 # distribution-metadata authority; this constant is aligned at publication
 # time.
-__version__: Final[str] = "1.3.1"
+__version__: Final[str] = "1.4.4"
 
 # The facade is imported last so the constants above are already bound: the
 # spawn path reads ``EXPECTED_SCHEMA_FINGERPRINT`` (lazily, at initialize
@@ -108,6 +109,7 @@ from .facade import (  # noqa: E402
     MuseClientOptions,
     MuseClientSpawnOptions,
     MuseHostDiedError,
+    MuseHostStartError,
     PendingCommandView,
     ResumeSessionOptions,
     SendUserTurnOptions,

{muse_code_sdk-1.3.1 → muse_code_sdk-1.4.4}/src/muse_code/connection/spawn.py

@@ -897,6 +897,11 @@ class MspHandshake:
         self._transport = child._transport
         self._connection = connection
         self._started = False
+        # Did ``initialize`` get an answer before the handshake failed? Read
+        # by the facade, never a public member: it lets ``MuseClient.spawn``
+        # say truthfully that a host died AFTER answering, while the
+        # ``initialized`` notification was being sent.
+        self._answered = False
         self._transport._adopt_flush_source(connection._submission_tail)
 
     @property
@@ -957,6 +962,7 @@ class MspHandshake:
         # stays a no-op.
         try:
             raw: Any = await self._connection.request("initialize", dict(params))
+            self._answered = True
             # The contract frame seam: the members this
             # handshake reads validate through a pydantic model, so a
             # malformed frame is the typed MuseValidationError — the seam

{muse_code_sdk-1.3.1 → muse_code_sdk-1.4.4}/src/muse_code/facade/__init__.py

@@ -39,6 +39,7 @@ from .host_death import (
     is_abnormal_host_death,
     read_session_durability,
 )
+from .host_start import MuseHostStartError
 from .session import (
     PendingCommandView,
     Session,
@@ -67,6 +68,7 @@ __all__ = [
     "MuseClientOptions",
     "MuseClientSpawnOptions",
     "MuseHostDiedError",
+    "MuseHostStartError",
     "PendingCommandView",
     "ResumeSessionOptions",
     "SendUserTurnOptions",

{muse_code_sdk-1.3.1 → muse_code_sdk-1.4.4}/src/muse_code/facade/approval.py

@@ -17,11 +17,16 @@ request upstream, never a local interface.
 
 from __future__ import annotations
 
+import asyncio
 import inspect
 from dataclasses import dataclass
 from typing import Any, Awaitable, Callable, Literal, Union
 
-from muse_code_msp import ApprovalDecideParams, ApprovalRequestParams
+from muse_code_msp import (
+    ApprovalDecideParams,
+    ApprovalRequestParams,
+    ApprovalUpdatedParams,
+)
 
 from ..connection.connection import Connection
 
@@ -37,6 +42,40 @@ assert _DECIDE_FORWARDED | {"commandId"} == (
     ApprovalDecideParams.__required_keys__ | ApprovalDecideParams.__optional_keys__
 ), "approval/decide grew a member — forward it through ApprovalRouter"
 
+# The refreshed-request merge in ``ApprovalRouter.updated``, listed by SOURCE:
+# stage-scoped members come from the ``approval/updated`` frame, identity
+# members from the retained request (stable across the stages of one
+# approval). A regenerated member, required or optional, fails this import
+# until it is given a side; otherwise it would silently vanish from every
+# later stage's request.
+_REFRESH_FROM_UPDATE = frozenset(
+    {
+        "availableChoices",
+        "currentRequirementId",
+        "sessionId",
+        "sourceRange",
+        "subagentOrigin",
+        "subject",
+        "viewCursor",
+    }
+)
+_REFRESH_FROM_REQUEST = frozenset(
+    {
+        "approvalId",
+        "itemId",
+        "judgeEscalated",
+        "protectedWrite",
+        "rawArgs",
+        "taskId",
+        "toolCallId",
+        "toolName",
+        "turnId",
+    }
+)
+assert _REFRESH_FROM_UPDATE | _REFRESH_FROM_REQUEST == (
+    ApprovalRequestParams.__required_keys__ | ApprovalRequestParams.__optional_keys__
+), "approval/requested grew a member — give it a side in ApprovalRouter.updated"
+
 
 @dataclass(frozen=True)
 class ApprovalDecisionInput:
@@ -107,7 +146,8 @@ ApprovalFailureHandler = Callable[[ApprovalFailure], None]
 
 
 class ApprovalRouter:
-    """Routes folded ``approval/requested`` frames to the consumer's handler
+    """Routes folded ``approval/requested`` frames, and ``approval/updated``
+    frames that advance a pending approval's stage, to the consumer's handler
     and authors the ``approval/decide`` command."""
 
     def __init__(self, session_id: str, connection: Connection | None) -> None:
@@ -131,6 +171,14 @@ class ApprovalRouter:
         # ``requirementId`` and therefore a new key, so "ask the consumer once
         # per stage" holds absolutely.
         self._decided_stages: set[str] = set()
+        # Approvals whose own decide ack said ``terminal: true``: the host
+        # closed the whole approval, so a trailing stage update names nobody's
+        # question.
+        self._terminal_approvals: set[str] = set()
+        # The decide each approval has on the wire, set when its ack lands.
+        # An update read in the same chunk as a ``terminal: true`` ack is
+        # folded before that decide resumes, so the update must wait for it.
+        self._in_flight: dict[str, asyncio.Event] = {}
 
     def on_approval(self, handler: ApprovalHandler) -> None:
         """Register the decision callback.
@@ -189,6 +237,63 @@ class ApprovalRouter:
             return None
         return self._decide(connection, params, handler)
 
+    def updated(
+        self,
+        requested: ApprovalRequestParams,
+        params: ApprovalUpdatedParams,
+    ) -> Awaitable[None] | None:
+        """An ``approval/updated`` folded onto a STILL-PENDING approval.
+
+        A multi-stage approval advances ``currentRequirementId`` through this
+        frame alone on the notification plane, so waiting for a re-issued
+        ``approval/requested`` would leave the new stage undecided and the turn
+        pending. The update carries none of the request's identity members,
+        but the fold retains the original request and those members are stable
+        across the stages of one approval, so the merged request is honest.
+        Routing it through :meth:`requested` reuses the per-stage latch: an
+        update naming an already-decided stage authors nothing.
+        """
+        # ``alreadyTerminal``: the host holds a durable terminal whose resolve
+        # frame has not landed yet; a decision against it can only bounce.
+        if params["change"]["kind"] == "alreadyTerminal":
+            return None
+        if requested["approvalId"] in self._terminal_approvals:
+            return None
+        refreshed: ApprovalRequestParams = {
+            "approvalId": requested["approvalId"],
+            "availableChoices": params["availableChoices"],
+            "currentRequirementId": params["currentRequirementId"],
+            "itemId": requested["itemId"],
+            "judgeEscalated": requested["judgeEscalated"],
+            "protectedWrite": requested["protectedWrite"],
+            "rawArgs": requested["rawArgs"],
+            "sessionId": params["sessionId"],
+            "sourceRange": params["sourceRange"],
+            "subject": params["subject"],
+            "taskId": requested["taskId"],
+            "toolCallId": requested["toolCallId"],
+            "toolName": requested["toolName"],
+            "turnId": requested["turnId"],
+            "viewCursor": params["viewCursor"],
+        }
+        # Omitted rather than nulled when absent, like ``feedback`` below.
+        if "subagentOrigin" in params:
+            refreshed["subagentOrigin"] = params["subagentOrigin"]
+        acked = self._in_flight.get(requested["approvalId"])
+        if acked is not None:
+            return self._after_ack(acked, refreshed)
+        return self.requested(refreshed)
+
+    async def _after_ack(
+        self, acked: asyncio.Event, refreshed: ApprovalRequestParams
+    ) -> None:
+        await acked.wait()
+        if refreshed["approvalId"] in self._terminal_approvals:
+            return
+        decided = self.requested(refreshed)
+        if decided is not None:
+            await decided
+
     @staticmethod
     def _stage_key(params: ApprovalRequestParams) -> str:
         requirement = params["currentRequirementId"]
@@ -252,14 +357,26 @@ class ApprovalRouter:
         if feedback is not None:
             decide_params["feedback"] = feedback
 
+        # The wait covers only this round trip: an update for this approval
+        # read before the ack lands waits for it, while a handler still open
+        # or a decide that never started blocks nobody.
+        approval_id = params["approvalId"]
+        acked = asyncio.Event()
+        self._in_flight[approval_id] = acked
         try:
             # No explicit ``command_id``: unlike ``send_user_turn``, nothing
             # here needs the id before the ack, so ``Connection.command()``
             # mints and stamps it — and its own same-id retry then reuses that
             # id for free.
-            await connection.command("approval/decide", decide_params)
+            result = await connection.command("approval/decide", decide_params)
+            if result.get("terminal") is True:
+                self._terminal_approvals.add(approval_id)
         except Exception as error:  # noqa: BLE001 - reported, never escapes
-            self._report(SubmitFailed(approval_id=params["approvalId"], error=error))
+            self._report(SubmitFailed(approval_id=approval_id, error=error))
+        finally:
+            acked.set()
+            if self._in_flight.get(approval_id) is acked:
+                del self._in_flight[approval_id]
 
     def _report(self, failure: ApprovalFailure) -> None:
         handler = self._on_failure

{muse_code_sdk-1.3.1 → muse_code_sdk-1.4.4}/src/muse_code/facade/client.py

@@ -23,7 +23,17 @@ from __future__ import annotations
 
 import asyncio
 from dataclasses import dataclass, fields
-from typing import Any, Awaitable, Generic, Mapping, Sequence, Set, TypeVar
+from typing import (
+    Any,
+    Awaitable,
+    Callable,
+    Generic,
+    List,
+    Mapping,
+    Sequence,
+    Set,
+    TypeVar,
+)
 
 from muse_code_msp import (
     ClientCapabilities,
@@ -45,6 +55,7 @@ from ..connection.spawn import (
 )
 from ..errors import MuseSessionDiscardedError
 from .discarded import DiscardedSessions
+from .host_start import MuseHostStartError, keeps_its_own_error
 from .host_death import (
     SessionDurabilityProfile,
     TransportEof,
@@ -77,6 +88,9 @@ class StartSessionOptions:
         session_id: A caller-chosen session id; omitted = the host mints one.
         workspace_root: The workspace the session works in; omitted = the
             host decides.
+        workspace_roots: The session's initial runtime workspace-root set
+            (wire ``workspaceRoots``; first root = the CWD). When
+            ``workspace_root`` is also given the two must agree.
         model_id: The model to serve the session with; omitted = the
             provider's default.
     """
@@ -85,6 +99,7 @@ class StartSessionOptions:
     provider_id: str | None = None
     session_id: str | None = None
     workspace_root: str | None = None
+    workspace_roots: List[str] | None = None
     model_id: str | None = None
 
 
@@ -200,6 +215,14 @@ class MuseClient(Generic[_I]):
         # sharing knob would be declared-ahead surface (Constitution XI).
         self._discarded = DiscardedSessions()
         self._sessions: Set[Session[_I]] = set()
+        # Frames naming a session this client has not registered YET, held
+        # only while a ``session/start``/``session/resume`` is in flight: the
+        # host flushes the resume replay BEFORE the result, and the coroutine
+        # awaiting that result resumes only after the whole chunk has been
+        # routed. ``_route`` holds, ``_open_session`` drains,
+        # ``_open`` clears when the last open settles.
+        self._opening = 0
+        self._held: dict[str, List[Mapping[str, Any]]] = {}
         host = options.host
         self._child: MuseServeChild | None = host.child if host is not None else None
         self._initialize_result: InitializeResult | None = (
@@ -235,6 +258,19 @@ class MuseClient(Generic[_I]):
 
         Returns:
             A wired client, its connection already initialized.
+
+        Raises:
+            MuseHostStartError: The host ended before the handshake
+                completed; it carries the exit classification row, the
+                bounded stderr tail, and ``answered_initialize`` (``True``
+                when the host answered ``initialize`` and died while this
+                client sent ``initialized``). A host whose answer was itself
+                the failure — its own error, a fingerprint mismatch or a
+                malformed result — keeps that error; an ``initialize`` frame
+                this client cannot encode (for example a non-UTF-8
+                ``client_info``) keeps its ``ProtocolError``; a cancellation
+                stays a cancellation; and a binary that cannot be started
+                raises the operating system's own error from the spawn call.
         """
         handshake = await spawn_msp_connection(
             options.muse_bin,
@@ -256,7 +292,7 @@ class MuseClient(Generic[_I]):
             init_params["capabilities"] = options.capabilities
         try:
             spawned = await handshake.initialize(init_params)
-        except BaseException:
+        except BaseException as error:
             # A failed handshake must not leak the process it already spawned.
             # (``initialize`` already closes on its own failure paths; this is
             # the belt-and-braces close for anything that escapes it.)
@@ -264,7 +300,22 @@ class MuseClient(Generic[_I]):
                 await handshake.close()
             except BaseException:
                 pass
-            raise
+            # A cancellation or interrupt is the caller's, a frame that never
+            # left this process is the caller's, and a host that ANSWERED was
+            # not lost: decided before the exit is read, so our own close
+            # ladder can never dress any of them up as a death.
+            if not isinstance(error, Exception) or keeps_its_own_error(error):
+                raise
+            # The host was lost: before answering, or after a usable answer
+            # while we sent ``initialized`` (the error then says so). close()
+            # ended at its observed exit, so the row is settled: raise it with
+            # the stderr tail instead of the transport's first symptom.
+            child = handshake.child
+            raise MuseHostStartError(
+                await child.exit,
+                child.stderr_tail,
+                answered_initialize=handshake._answered,
+            ) from error
         return MuseClient(
             spawned.connection,
             MuseClientOptions(
@@ -322,17 +373,14 @@ class MuseClient(Generic[_I]):
             params["sessionId"] = options.session_id
         if options.workspace_root is not None:
             params["workspaceRoot"] = options.workspace_root
+        if options.workspace_roots is not None:
+            params["workspaceRoots"] = options.workspace_roots
         if options.model_id is not None:
             params["modelId"] = options.model_id
-        raw = await self._connection.command("session/start", params)
-        result: Mapping[str, Any] = raw
         # Keyed by the id the SERVER named, never the one the caller asked for:
         # ``sessionId`` is a REQUEST on start, and a session keyed by a hopeful
         # id would reject every one of its own events as foreign.
-        return self._open_session(
-            str(result["session"]["sessionId"]),
-            _StartOpening(result=result),
-        )
+        return await self._open("session/start", params, _StartOpening)
 
     async def resume_session(self, options: ResumeSessionOptions) -> Session[_I]:
         """Load an existing session and subscribe this connection to its view.
@@ -349,12 +397,7 @@ class MuseClient(Generic[_I]):
             params["excludeItems"] = options.exclude_items
         if options.history is not None:
             params["history"] = options.history
-        raw = await self._connection.command("session/resume", params)
-        result: Mapping[str, Any] = raw
-        return self._open_session(
-            str(result["session"]["sessionId"]),
-            _ResumeOpening(result=result),
-        )
+        return await self._open("session/resume", params, _ResumeOpening)
 
     async def close(self) -> None:
         """Shut the host down in an orderly way.
@@ -378,6 +421,29 @@ class MuseClient(Generic[_I]):
             return
         await self._connection.close()
 
+    async def _open(
+        self,
+        verb: str,
+        params: dict[str, Any],
+        opening: Callable[[Mapping[str, Any]], SessionOpening],
+    ) -> Session[_I]:
+        # The window ``_route`` holds unknown-session frames for: from the
+        # request to the Session's registration. Counted, not flagged, so two
+        # concurrent opens keep it open until the LAST settles; cleared on
+        # settle so a frame that named no session this client opened is held
+        # no longer than the open it rode in with.
+        self._opening += 1
+        try:
+            raw = await self._connection.command(verb, params)
+            result: Mapping[str, Any] = raw
+            return self._open_session(
+                str(result["session"]["sessionId"]), opening(result)
+            )
+        finally:
+            self._opening -= 1
+            if self._opening == 0:
+                self._held.clear()
+
     def _open_session(
         self, session_id: str, opening: SessionOpening
     ) -> Session[_I]:
@@ -389,6 +455,11 @@ class MuseClient(Generic[_I]):
             opening=opening,
         )
         self._sessions.add(session)
+        # The frames that named this session while its verb was in flight
+        # fold NOW, in arrival order — synchronously, so nothing the pump
+        # routes next can overtake them.
+        for held in self._held.pop(session_id, ()):
+            session.apply(held)
         return session
 
     def _assert_reattach_allowed(self, session_id: str) -> None:
@@ -408,16 +479,25 @@ class MuseClient(Generic[_I]):
 
     def _route(self, notification: Mapping[str, Any]) -> None:
         # Deliver one view notification to the session(s) it names. A frame
-        # naming NO session is dropped here rather than fed to every session,
-        # and a frame naming an UNKNOWN session is dropped for the same reason
+        # naming NO session is dropped here rather than fed to every session
         # — routing it anywhere would trip the foreign-frame throw.
         params = notification.get("params")
         named = params.get("sessionId") if isinstance(params, dict) else None
         if not isinstance(named, str):
             return
+        delivered = False
         for session in self._sessions:
             if session.session_id == named:
                 session.apply(notification)
+                delivered = True
+        # An UNKNOWN session with no open in flight is dropped, for the same
+        # reason as a nameless frame.
+        if delivered or self._opening == 0:
+            return
+        # An open is in flight and this may be ITS session, named by the
+        # server before the awaiting coroutine has run: hold it for
+        # ``_open_session`` to fold, or for ``_open`` to clear.
+        self._held.setdefault(named, []).append(notification)
 
     async def _watch_closed(self) -> None:
         try:

{muse_code_sdk-1.3.1 → muse_code_sdk-1.4.4}/src/muse_code/facade/gap_fill.py

@@ -284,10 +284,15 @@ class GapFiller(Generic[_I]):
                 return
             result = await self._page(connection, self._cursor)
             reached = False
+            # The last cursor this page served, skipped events included —
+            # where a walk toward an extended target resumes after an
+            # end-of-view page.
+            last_served: str | None = None
             events = result["events"]
             for event in events:
                 self._require_own_session(event, after, target)
                 cursor = str(event["params"]["viewCursor"])
+                last_served = cursor
                 # An EARLIER fill already served — and applied — this durable
                 # event. A later walk may legally page through the same range,
                 # and re-applying it here is the same double fold the discard
@@ -317,7 +322,15 @@ class GapFiller(Generic[_I]):
             # the protocol), so a hole whose tail was ephemeral ends here and never
             # at ``target``. An ABSENT ``nextCursor`` is a different fact — the
             # member is "never omitted", so it falls through to the stall arm.
+            #
+            # The cursor still advances to the last event served: if a
+            # ``view/gap`` extended the target while this page was in flight,
+            # ``_walk`` comes back here toward the new one, and re-asking from
+            # where this walk started would re-serve, and fold a second time,
+            # every event this page just delivered.
             if "nextCursor" in result and result["nextCursor"] is None:
+                if last_served is not None:
+                    self._cursor = last_served
                 return
             next_cursor = result.get("nextCursor")
             # PROGRESS is the only bound on this walk, and it has to be,

muse_code_sdk-1.4.4/src/muse_code/facade/host_start.py

@@ -0,0 +1,115 @@
+"""The typed failure of :meth:`MuseClient.spawn` when the host is lost before
+the handshake completes.
+
+Without it the exception is whatever the transport saw first — usually
+``ProtocolError("connection reached EOF")`` — while the evidence that explains
+it (the exit classification row and the bounded stderr tail) sits unread on
+the child the facade already owns. Every process-exit error carries that
+evidence; this module is the handshake-failure arm of that rule.
+
+A binary that cannot be started is not this error: it raises the operating
+system's own error (``FileNotFoundError``, ``PermissionError``) from the spawn
+call, before any handshake exists, so no process ran and there is no row to
+attach.
+"""
+
+from __future__ import annotations
+
+from typing import Tuple
+
+from ..connection.connection import MspError, ProtocolError, _UnencodableFrameError
+from ..connection.spawn import ExitClassification
+from ..errors import MuseHostMismatchError, MuseValidationError
+
+_MESSAGE_TAIL_LINES = 5
+"""How many tail lines the message quotes; ``stderr_tail`` carries them all."""
+
+
+class MuseHostStartError(Exception):
+    """:meth:`MuseClient.spawn` lost its host before ``initialize`` was answered.
+
+    Typed rather than a bare ``Exception`` because ``exit.kind`` and
+    ``exit.retry`` name STATES an embedder branches on (fix the configuration,
+    wait for a lease, give up). The transport error that first surfaced the
+    loss rides as ``__cause__``, so nothing the old exception carried is lost.
+
+    Attributes:
+        exit: The host's exit classification row — any row, the clean one
+            included: a host that wrote its complaint to stderr and exited 0
+            before its first frame is still a lost host, and the row says
+            only how it ended.
+        stderr_tail: The SDK's bounded stderr tail when the host was lost.
+            The only carrier of that evidence when the row is
+            ``cleanShutdown``, which keeps no tail of its own.
+        answered_initialize: Whether the host got as far as an
+            ``initialize`` answer before it was lost. ``True`` means it
+            started and answered, then died while this client was completing
+            the handshake — not a startup problem.
+    """
+
+    def __init__(
+        self,
+        exit: ExitClassification,  # noqa: A002 - mirrors the row's name
+        stderr_tail: Tuple[str, ...],
+        *,
+        answered_initialize: bool,
+    ) -> None:
+        """Builds the error; raise it ``from`` the transport error.
+
+        Args:
+            exit: The observed exit's classification row.
+            stderr_tail: The bounded stderr evidence.
+            answered_initialize: Whether ``initialize`` was answered first.
+        """
+        super().__init__(_describe(exit, stderr_tail, answered_initialize))
+        self.exit: ExitClassification = exit
+        self.stderr_tail: Tuple[str, ...] = stderr_tail
+        self.answered_initialize: bool = answered_initialize
+
+
+def _describe(
+    exit: ExitClassification,  # noqa: A002
+    tail: Tuple[str, ...],
+    answered_initialize: bool,
+) -> str:
+    if exit.kind == "cleanShutdown":
+        how = "exit code 0"
+    elif exit.exit_signal is not None:
+        how = f"signal {exit.exit_signal}"
+    else:
+        how = f"exit code {exit.exit_code}"
+        if exit.retry is not None:
+            how += f", retry: {exit.retry}"
+    quoted = tail[-_MESSAGE_TAIL_LINES:]
+    if not tail:
+        evidence = "stderr tail: (empty)"
+    else:
+        count = (
+            f" (last {len(quoted)} of {len(tail)} lines)" if len(quoted) < len(tail) else ""
+        )
+        evidence = f"stderr tail{count}:\n  " + "\n  ".join(quoted)
+    when = (
+        "after answering initialize, before the handshake completed"
+        if answered_initialize
+        else "before answering initialize"
+    )
+    return f"muse host exited {when}: {exit.kind} ({how}); {evidence}"
+
+
+def keeps_its_own_error(error: BaseException) -> bool:
+    """Is this handshake failure something other than a lost host?
+
+    "Lost" is decided by whether the failure carries the host's answer,
+    never by how it ended:
+    its own error, a fingerprint mismatch, a result this SDK refused as
+    malformed, or any protocol violation that carries the refused frame are
+    all answers, and each is a more useful error than the exit our own
+    ``close()`` then caused. An ``initialize`` frame that could not even be
+    encoded never reached the host: that is the caller's defect, and the
+    host it was meant for is not to blame.
+    """
+    if isinstance(error, (MspError, MuseHostMismatchError, MuseValidationError)):
+        return True
+    if isinstance(error, _UnencodableFrameError):
+        return True
+    return isinstance(error, ProtocolError) and error.line is not None

{muse_code_sdk-1.3.1 → muse_code_sdk-1.4.4}/src/muse_code/facade/session.py

@@ -34,6 +34,7 @@ from typing import (
 from muse_code_msp import (
     ITEM_KIND_KNOWN_VALUES,
     ApprovalRequestParams,
+    ApprovalUpdatedParams,
     Item,
     ItemDeltaParams,
     TurnCompletedParams,
@@ -612,6 +613,18 @@ class Session(Generic[_I]):
                 self._approval_requested(
                     cast(ApprovalRequestParams, params), sink.tasks
                 )
+        elif method == "approval/updated":
+            # A stage advance arrives as this frame alone on the notification
+            # plane, so it must drive the handler too (see
+            # ``ApprovalRouter.updated``). The same fold verdict gates it: an
+            # update the fold IGNORED (unknown or already-resolved approval)
+            # authors nothing.
+            if isinstance(outcome, ApprovalPending):
+                self._approval_updated(
+                    cast(ApprovalRequestParams, outcome.requested),
+                    cast(ApprovalUpdatedParams, params),
+                    sink.tasks,
+                )
         # ``view/gap`` deliberately routes to no turn: it names a hole in
         # DELIVERY, so what it moves is the fold's currency, and the recovery
         # it triggers is started by ``apply`` off the ``DeliveryGap`` verdict
@@ -895,6 +908,16 @@ class Session(Generic[_I]):
         if decided is not None:
             tasks.append(_decided_io(decided))
 
+    def _approval_updated(
+        self,
+        requested: ApprovalRequestParams,
+        params: ApprovalUpdatedParams,
+        tasks: List[Awaitable[tuple[PendingRetirement[_I], ...]]],
+    ) -> None:
+        decided = self._approvals.updated(requested, params)
+        if decided is not None:
+            tasks.append(_decided_io(decided))
+
     def _items_of_turn(self, turn_id: str) -> tuple[Item, ...]:
         return tuple(
             cast(Item, item)