refactor(ptc): simplify model-visible state and recovery messages

packages/core/tool-executor-ptc/README.i18n.yaml

@@ -21,8 +21,8 @@
   en: d6d7788495837ef2
   zh: 4f7e62d5c2e87022
 /deepseek-ai-dsh-tool-executor-ptc/understand-the-implementation/ptc-mode:
-  en: 77b321779e07ad12
-  zh: 0847c71f22454299
+  en: 8d66a5a26127249d
+  zh: 87b598317cc7a307
 /deepseek-ai-dsh-tool-executor-ptc/further-exploration:
   en: ee69078c38c655a9
   zh: fb0873407f23c8c5

packages/core/tool-executor-ptc/README.md

@@ -63,7 +63,7 @@ When the caller cancels and the runtime reports `abort`, `run_code` waits for cl
 
 `run_code` accepts `timeoutMs` when the mounted runtime supports an override; its schema reports the configured default and maximum, and the runtime's usage instructions. The Node default is 120,000 ms with a 600,000 ms cap, including nested tool and approval waits. A wider `sandbox_permissions` mode requires a non-empty `justification` and approval before the program starts. The schema asks the model to write that reason in the current user's language. The grant applies to that complete execution; standing Session policy and nested tools retain their own authority. Programs are never replayed automatically: inspect earlier effects before explicitly retrying a denied program. Retained PTC environments follow the standing file policy. PTC observes committed Session mode changes and immediately cancels affected calls in all Node modes. Later PTC calls wait for their nested-tool cleanup before resolving the latest policy. The runtime owns process invalidation and cleanup; permission setters remain synchronous. One-time escalations omit the state owner and complete in a temporary environment; standing variables remain available to ordinary calls.
 
-Custom host integrations retain their `PtcExecutor` instance and call `reset(agent)` to clear that Agent's environment; reset is not a model tool or SDK binding. It requires a state-retaining runtime, cancels active calls, invokes `release(agent)`, and waits for process and started nested-tool cleanup without requiring the program to respond. It then queues context about cleared variables before admitting new programs. The notice is logged when consumed; cancellation or Agent disposal can discard it after state is cleared. Concurrent resets share cleanup. Missing or unsupported runtimes reject without blocking admission. Cleanup or notice-admission failure throws `CodeResetFailedError`; later programs report `CodeRunFailedError` with host-reset guidance until an explicit retry succeeds. Reset does not undo completed tool effects.
+Custom host integrations retain their `PtcExecutor` instance and call `reset(agent)` to clear that Agent's environment; reset is not a model tool or SDK binding. It requires a state-retaining runtime, cancels active calls, invokes `release(agent)`, and waits for process and started nested-tool cleanup without requiring the program to respond. Before admitting new programs, it queues `Program environment reset; retained variables cleared. Completed tool effects remain.` The notice is logged when consumed; cancellation or Agent disposal can discard it after state is cleared. Concurrent resets share cleanup. Missing or unsupported runtimes reject without blocking admission. Cleanup or notice-admission failure throws `CodeResetFailedError`; later programs report `CodeRunFailedError` with host-reset guidance until an explicit retry succeeds. Reset does not undo completed tool effects.
 
 - [`src/index.ts`](src/index.ts) — Validated configuration and scoped registration; tool descriptions and batch execution.
 

packages/core/tool-executor-ptc/README.zh.md

@@ -63,7 +63,7 @@ PTC 执行器公开保留的 `run_code` 传输，以及按所加载运行时语
 
 当已挂载运行时支持覆盖时，`run_code` 接受 `timeoutMs`；其 schema 报告配置的默认值和上限以及运行时使用说明。Node 默认值为 120,000 ms，上限为 600,000 ms，包含嵌套工具和审批等待。更宽的 `sandbox_permissions` 模式要求非空 `justification`，并在程序启动前获得审批。schema 提示模型使用当前用户的语言撰写理由。授权仅用于该次完整执行；常驻 Session 策略与嵌套工具保留各自权限。程序不会自动重放：显式重试被拒程序前，应检查先前已发生的效果。 保留状态的 PTC 环境遵循会话文件策略。PTC 观察已提交的 Session 模式变化，并立即取消所有 Node 模式下受影响的调用。后续 PTC 调用等待这些调用的嵌套工具清理后，再解析最新策略。运行时负责进程失效和清理，权限设置保持同步。单次提权省略状态所有者，在临时环境中执行；普通调用仍可访问原环境的变量。
 
-自定义宿主集成保留自己的 `PtcExecutor` 实例，通过 `reset(agent)` 清空该 Agent 的环境；重置不是模型工具或 SDK 绑定。该操作要求运行时保留状态，会取消活动调用、调用 `release(agent)`，并等待进程及已启动嵌套工具的清理，无需程序响应。随后，它先排入变量已清空的上下文，再接纳新程序。通知消费时写入日志；取消或 Agent 销毁可能在状态已清空后丢弃通知。并发重置共享清理过程。运行时缺失或不受支持时，操作拒绝但不阻止后续准入。清理或通知入队失败会抛出 `CodeResetFailedError`；后续程序报告带宿主重置指引的 `CodeRunFailedError`，直到显式重试成功。重置不会撤销已完成的工具操作。
+自定义宿主集成保留自己的 `PtcExecutor` 实例，通过 `reset(agent)` 清空该 Agent 的环境；重置不是模型工具或 SDK 绑定。该操作要求运行时保留状态，会取消活动调用、调用 `release(agent)`，并等待进程及已启动嵌套工具的清理，无需程序响应。接纳新程序前，它排入 `Program environment reset; retained variables cleared. Completed tool effects remain.` 上下文。通知消费时写入日志；取消或 Agent 销毁可能在状态已清空后丢弃通知。并发重置共享清理过程。运行时缺失或不受支持时，操作拒绝但不阻止后续准入。清理或通知入队失败会抛出 `CodeResetFailedError`；后续程序报告带宿主重置指引的 `CodeRunFailedError`，直到显式重试成功。重置不会撤销已完成的工具操作。
 
 - [`src/index.ts`](src/index.ts) — 配置校验和作用域注册；工具描述和批次执行。
 

packages/core/tool-executor-ptc/src/ptc-calls.ts

@@ -58,7 +58,7 @@ export class PtcCalls {
       const reset = this.resets.get(sessionId)
       if (reset !== undefined) {
         try { await reset.done } catch (error) {
-          throw new CodeRunFailedError(`Program environment is unavailable after a failed host reset: ${toolErrorMessage(error)}. State may not be cleared; ask the host to retry reset before running more code.`)
+          throw new CodeRunFailedError(`Program environment unavailable: ${toolErrorMessage(error)}. Ask the host to reset it before running more code.`)
         }
         continue
       }

packages/core/tool-executor-ptc/src/reset.ts

@@ -20,7 +20,7 @@ export async function resetPtcEnvironment(ctx: Context, calls: PtcCalls, agent:
   try {
     await calls.reset(agent.session.id, () => runtime.release(agent), () => {
       agent.inject(createUserMessage({
-        content: [{ type: 'text', text: 'The host reset the program environment. All retained variables have been cleared. The next run_code starts fresh. Completed tool effects have not been undone.' }],
+        content: [{ type: 'text', text: 'Program environment reset; retained variables cleared. Completed tool effects remain.' }],
         source: { kind: 'ptc-mode' },
       }))
     })

packages/core/tool-executor-ptc/tests/ptc-calls.spec.ts

@@ -134,7 +134,7 @@ it('waits for call cleanup after release fails and refuses code until an explici
     cleanup.resolve(undefined)
     await Promise.all([first, rejection, nextRejection])
     await expect(calls.run(session.id, signal, mode, nextBody)).rejects.toThrow(CodeRunFailedError)
-    await expect(calls.run(session.id, signal, mode, nextBody)).rejects.toThrow('ask the host to retry reset')
+    await expect(calls.run(session.id, signal, mode, nextBody)).rejects.toThrow('Ask the host to reset it before running more code')
     expect(nextBody).not.toHaveBeenCalled()
     await calls.reset(session.id, async () => {})
     expect(await calls.run(session.id, signal, mode, async () => 'fresh')).toBe('fresh')
@@ -145,7 +145,7 @@ it('keeps admission blocked if the reset notice cannot be queued', async () => {
   const { session, calls, mode, signal } = await setup()
   await expect(calls.reset(session.id, async () => {}, () => { throw new Error('notice failed') })).rejects.toThrow('notice failed')
   const next = vi.fn(async () => 'fresh')
-  await expect(calls.run(session.id, signal, mode, next)).rejects.toThrow('ask the host to retry reset')
+  await expect(calls.run(session.id, signal, mode, next)).rejects.toThrow('Ask the host to reset it before running more code')
   expect(next).not.toHaveBeenCalled()
   await calls.reset(session.id, async () => {})
   expect(await calls.run(session.id, signal, mode, next)).toBe('fresh')

packages/core/tool-executor-ptc/tests/ptc.spec.ts

@@ -2403,7 +2403,7 @@ describe('host environment reset', () => {
     await reset()
     expect(release).toHaveBeenCalledExactlyOnceWith(agent)
     expect(inject).toHaveBeenCalledExactlyOnceWith(expect.objectContaining({
-      content: [{ type: 'text', text: 'The host reset the program environment. All retained variables have been cleared. The next run_code starts fresh. Completed tool effects have not been undone.' }],
+      content: [{ type: 'text', text: 'Program environment reset; retained variables cleared. Completed tool effects remain.' }],
       source: { kind: 'ptc-mode' },
     }))
     vi.spyOn(runtime, 'retainsState', 'get').mockReturnValue(false)
@@ -2451,7 +2451,7 @@ describe('host environment reset', () => {
     const blocked = await runCode(ctx, '1', { agent })
     expect(blocked.isError).toBe(true)
     expect(blocked.error?.info?.code).toBe('CODE_RUN_FAILED')
-    expect(blocked.content.find(block => block.type === 'text')?.text).toContain('ask the host to retry reset')
+    expect(blocked.content.find(block => block.type === 'text')?.text).toContain('Ask the host to reset it before running more code')
     expect(run).not.toHaveBeenCalled()
     await reset()
     expect(inject).toHaveBeenCalledOnce()

packages/ptc-runtime/ptc-runtime-node/README.i18n.yaml

@@ -27,8 +27,8 @@
   en: fe1343b3dcf3fd4a
   zh: 3e758eaa441e3b85
 /deepseek-ai-dsh-ptc-runtime-node/use-this-package/deadlines-and-cancellation:
-  en: 9b3e580282c00449
-  zh: 84f8cbebbd97fcfa
+  en: aaf5ea5635a57993
+  zh: 0fa91b11f13c2a15
 /deepseek-ai-dsh-ptc-runtime-node/use-this-package/failures:
   en: 34a221d0f26b8e47
   zh: 2fd20ac9c9953c7f

packages/ptc-runtime/ptc-runtime-node/README.md

@@ -105,7 +105,7 @@ For calls carrying a Session policy, a mode change cancels admission even while
 
 The PTC consumer exposes per-call timeout and approved sandbox choices as described in [dsh-tool-executor-ptc](../../core/tool-executor-ptc/README.md). The runtime's readonly `timeout` descriptor reports its effective default and maximum to that consumer. The provider owns execution syntax, output syntax and state-retention guidance in `executionInstructions`. The tool consumer appends those mode-specific rules to its model-visible schema without inferring persistence from `programFormat`.
 
-Omitting `timeoutMs` uses the configured elapsed default; numeric requests are validated and capped. Service callers can explicitly pass `timeoutMs: null` to omit the elapsed timer, as the workflow adapter does; `run_code` continues to accept only positive numeric overrides. An enabled deadline covers runtime setup and execution, including time awaiting nested tools or approval. It is not a CPU meter. Timeout results retain captured output and report `execution timed out before code started` until the program is submitted to the ready process, or `execution timed out during execution` afterward. Timeout or cancellation during retained execution requests cooperative revocation. Output produced after the stop request is discarded, including output from `catch` and `finally` handlers. Acknowledgment preserves the VM and variables, including earlier mutations. If the execution thread cannot acknowledge within `stopGraceMs`, or the acknowledgment fails, the host terminates the managed process range and waits for cleanup. The result remains `timeout` or `abort` and states whether variables were preserved or cleared. After confirmed termination, the next call creates an empty environment. Cleanup failure returns `worker-exit` and blocks reuse until host release succeeds. Startup timeouts, temporary execution stops and successful per-call completion terminate the managed process range immediately. The timer stops when an outcome is selected, before cleanup, so the returned call can take longer than its execution deadline while cleanup settles.
+Omitting `timeoutMs` uses the configured elapsed default; numeric requests are validated and capped. Service callers can explicitly pass `timeoutMs: null` to omit the elapsed timer, as the workflow adapter does; `run_code` continues to accept only positive numeric overrides. An enabled deadline covers runtime setup and execution, including time awaiting nested tools or approval. It is not a CPU meter. Timeout results retain captured output and report `execution timed out before code started` until the program is submitted to the ready process, or `execution timed out during execution` afterward. Timeout or cancellation during retained execution requests cooperative revocation. Output produced after the stop request is discarded, including output from `catch` and `finally` handlers. Acknowledgment preserves the VM and variables, including earlier mutations. If the execution thread cannot acknowledge within `stopGraceMs`, or the acknowledgment fails, the host terminates the managed process range and waits for cleanup. The result remains `timeout` or `abort` and reports whether variables were preserved or cleared; timeout messages also report the elapsed budget. After confirmed termination, the next call creates an empty environment. Cleanup failure returns `worker-exit` and blocks reuse until host release succeeds. Startup timeouts, temporary execution stops and successful per-call completion terminate the managed process range immediately. The timer stops when an outcome is selected, before cleanup, so the returned call can take longer than its execution deadline while cleanup settles.
 
 ### Failures
 

packages/ptc-runtime/ptc-runtime-node/README.zh.md

@@ -105,7 +105,7 @@ profile 编辑器可从 `@deepseek-ai/dsh-ptc-runtime-node/configuration` 导入
 
 PTC 消费方按 [dsh-tool-executor-ptc](../../core/tool-executor-ptc/README.zh.md) 的说明公开逐次超时与经审批的沙箱选择。运行时只读 `timeout` 描述符向该消费方报告有效默认值与上限。提供方通过 `executionInstructions` 负责求值语法、输出方式和状态保留指引。工具消费者将对应模式的规则附加到面向模型的 schema，不根据 `programFormat` 推断是否保留状态。
 
-省略 `timeoutMs` 使用配置的经过时间默认值；数值请求经过验证并封顶。服务调用方可以显式传入 `timeoutMs: null` 来省略经过时间定时器，工作流适配器即如此；`run_code` 仍只接受正数覆盖值。启用的截止覆盖运行时准备和执行，包括等待嵌套工具或审批的时间。它不是 CPU 计量器。超时结果保留已捕获的输出；在程序提交给就绪进程之前报告 `execution timed out before code started`，提交后报告 `execution timed out during execution`。保留环境中的执行超时或取消会请求协作式撤销。发出停止请求后产生的输出会被丢弃，包括 `catch` 和 `finally` 处理器的输出。收到确认后保留 VM 和变量，包括此前发生的修改。如果执行线程未在 `stopGraceMs` 内确认，或确认失败，宿主终止受管进程范围并等待清理。结果仍为 `timeout` 或 `abort`，并说明变量被保留还是清空。确认终止后，下一次调用创建空环境。清理失败返回 `worker-exit`，并阻止复用，直到宿主释放成功。启动前超时、临时执行停止以及逐次执行成功完成均立即终止受管进程范围。选择结果后、清理前停止计时器，因此调用可能要在执行截止之后等待清理结算才返回。
+省略 `timeoutMs` 使用配置的经过时间默认值；数值请求经过验证并封顶。服务调用方可以显式传入 `timeoutMs: null` 来省略经过时间定时器，工作流适配器即如此；`run_code` 仍只接受正数覆盖值。启用的截止覆盖运行时准备和执行，包括等待嵌套工具或审批的时间。它不是 CPU 计量器。超时结果保留已捕获的输出；在程序提交给就绪进程之前报告 `execution timed out before code started`，提交后报告 `execution timed out during execution`。保留环境中的执行超时或取消会请求协作式撤销。发出停止请求后产生的输出会被丢弃，包括 `catch` 和 `finally` 处理器的输出。收到确认后保留 VM 和变量，包括此前发生的修改。如果执行线程未在 `stopGraceMs` 内确认，或确认失败，宿主终止受管进程范围并等待清理。结果仍为 `timeout` 或 `abort`，并说明变量被保留还是清空；超时消息还会报告经过时间预算。确认终止后，下一次调用创建空环境。清理失败返回 `worker-exit`，并阻止复用，直到宿主释放成功。启动前超时、临时执行停止以及逐次执行成功完成均立即终止受管进程范围。选择结果后、清理前停止计时器，因此调用可能要在执行截止之后等待清理结算才返回。
 
 ### 失败
 

packages/ptc-runtime/ptc-runtime-node/src/execution.ts

@@ -146,7 +146,7 @@ function sameAdditionalRoots(left: readonly string[] | undefined, right: readonl
 
 const STRIP_PREFIX = 'async function __dsh_program__() {\n'
 const STRIP_SUFFIX = '\n}'
-const RETAINED_STATE_INSTRUCTIONS = 'Changing the session sandbox mode clears retained variables. An approved sandbox escalation runs in a separate temporary environment: it cannot access retained variables, and its declarations are discarded afterward. Restart, Agent disposal, output overflow, or process failure clears the environment. Timeout and cancellation request cooperative stop: retained variables survive if the runtime acknowledges; otherwise the host terminates the process and clears them. Earlier mutations are not rolled back. If a variable is undefined, recreate it and reacquire its resources. State is not restored from the conversation, and failed evaluations can leave earlier mutations in memory. Redeclaring an existing let, const, or class name fails; assign to a mutable binding or use a new name. Await all tool calls and required cleanup before returning; unfinished tool calls reject when the evaluation ends or is canceled, so catch and finally handlers can run. Output produced after a stop request is discarded, including output from catch and finally handlers. Background callbacks cannot call tools or emit captured output after their evaluation ends; unmanaged asynchronous work may still mutate retained variables. Collect child-process output explicitly and print it; inherited native stdout/stderr is excluded from retained execution output.'
+const RETAINED_STATE_INSTRUCTIONS = 'Timeout and cancellation results say whether retained variables were preserved or cleared. Restart, sandbox changes, output overflow, or process failure clears them. Recreate missing variables and resources; conversation history does not restore state. Earlier mutations and tool effects are not rolled back. Approved sandbox escalations use a fresh environment and discard its variables afterward. Do not redeclare existing let, const, or class names; reuse mutable bindings or choose new names. Await tools and cleanup before returning; unfinished tools reject. After completion, timeout, or cancellation, new tool calls are rejected and output is discarded; background work may still change state. Capture and print child-process output explicitly.'
 
 function resolveMode(config: ResolvedConfig): ExecutionMode {
   switch (config.executionMode) {

packages/ptc-runtime/ptc-runtime-node/src/worker.ts

@@ -179,8 +179,7 @@ export class ProgramWorker {
           const stopped = stopRequired ? { drained: await this.stop(), preserved: false }
             : interrupted ? await this.requestStop(evaluation.id) : { drained: true, preserved: true }
           if (interrupted && this.retainsState && error) {
-            const fallback = !stopRequired && !stopped.preserved ? '; runtime did not confirm stopping; runtime terminated' : ''
-            error = { ...error, message: `${error.message}${fallback}; retained variables were ${stopped.preserved ? 'preserved' : 'cleared'}` }
+            error = { ...error, message: `${error.message}; retained variables were ${stopped.preserved ? 'preserved' : 'cleared'}` }
           }
           const completed = complete()
           // The final stop diagnostic also consumes output budget.

packages/ptc-runtime/ptc-runtime-node/tests/persistent.spec.ts

@@ -260,7 +260,7 @@ describe.each([
       const result = await pending
       expect(result.logs).toEqual(['before stop'])
       expect(result.error?.kind).toBe(action)
-      expect(result.error?.message).toContain('runtime did not confirm stopping; runtime terminated; retained variables were cleared')
+      expect(result.error?.message).toContain('retained variables were cleared')
       expect((await run('typeof kept')).value).toBe('undefined')
     } finally { controller.abort(); await pending }
   })
@@ -276,7 +276,7 @@ describe.each([
     try {
       await expect.poll(async () => readFile(join(cwd, 'entered-loop'), 'utf8')).toBe('ready')
       controller.abort()
-      expect((await pending).error?.message).toContain('runtime terminated; retained variables were cleared')
+      expect((await pending).error?.message).toContain('retained variables were cleared')
       expect((await run('typeof kept')).value).toBe('undefined')
     } finally { controller.abort(); await pending }
   })
@@ -291,7 +291,7 @@ describe.each([
     await run('var kept = 42;')
     const result = await run(program, { timeoutMs: 200, bindings: bindings(() => new Promise(() => {})) })
     expect(result.error?.kind).toBe('timeout')
-    expect(result.error?.message).toContain('runtime terminated; retained variables were cleared')
+    expect(result.error?.message).toContain('retained variables were cleared')
     expect((await run('typeof kept')).value).toBe('undefined')
   })
 

packages/ptc-runtime/ptc-runtime-node/tests/timeout.spec.ts

@@ -130,7 +130,7 @@ describe.each(['timeout', 'abort'] as const)('retained %s', (action) => {
       }
       const result = await pending
       expect(result.error?.kind).toBe(action)
-      expect(result.error?.message).toContain('runtime terminated; retained variables were cleared')
+      expect(result.error?.message).toContain('retained variables were cleared')
       expect(h.terminate).toHaveBeenCalledOnce()
       expect(h.waitForExit).toHaveBeenCalledOnce()
       const replacement = fakeChild(h.ctx, h.runtime, { ...h.request, signal: new AbortController().signal })

snapshots/session/ptc-persistent/tool-schemas.expected.json

@@ -2,7 +2,7 @@
   "initial": [
     {
       "name": "run_code",
-      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the program to execute, and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Curate the program output. Image-bearing subtool results are attached after the run. The program contains TypeScript REPL statements; only erasable syntax is accepted, with no enum or namespaces. Type annotations are advisory. Top-level declarations and await are supported; top-level return is not supported. Emit output with console.log(...) or a final lossless JSON expression. Only printed values and that final expression become program output. Variables, functions, and imported modules remain in memory for this Agent across calls. Use await import(...) for modules. Direct filesystem access follows this execution's sandbox policy; process.env starts empty. Changing the session sandbox mode clears retained variables. An approved sandbox escalation runs in a separate temporary environment: it cannot access retained variables, and its declarations are discarded afterward. Restart, Agent disposal, output overflow, or process failure clears the environment. Timeout and cancellation request cooperative stop: retained variables survive if the runtime acknowledges; otherwise the host terminates the process and clears them. Earlier mutations are not rolled back. If a variable is undefined, recreate it and reacquire its resources. State is not restored from the conversation, and failed evaluations can leave earlier mutations in memory. Redeclaring an existing let, const, or class name fails; assign to a mutable binding or use a new name. Await all tool calls and required cleanup before returning; unfinished tool calls reject when the evaluation ends or is canceled, so catch and finally handlers can run. Output produced after a stop request is discarded, including output from catch and finally handlers. Background callbacks cannot call tools or emit captured output after their evaluation ends; unmanaged asynchronous work may still mutate retained variables. Collect child-process output explicitly and print it; inherited native stdout/stderr is excluded from retained execution output. Each program starts in the Session's current directory. Running programs keep their initial directory. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
+      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the program to execute, and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Curate the program output. Image-bearing subtool results are attached after the run. The program contains TypeScript REPL statements; only erasable syntax is accepted, with no enum or namespaces. Type annotations are advisory. Top-level declarations and await are supported; top-level return is not supported. Emit output with console.log(...) or a final lossless JSON expression. Only printed values and that final expression become program output. Variables, functions, and imported modules remain in memory for this Agent across calls. Use await import(...) for modules. Direct filesystem access follows this execution's sandbox policy; process.env starts empty. Timeout and cancellation results say whether retained variables were preserved or cleared. Restart, sandbox changes, output overflow, or process failure clears them. Recreate missing variables and resources; conversation history does not restore state. Earlier mutations and tool effects are not rolled back. Approved sandbox escalations use a fresh environment and discard its variables afterward. Do not redeclare existing let, const, or class names; reuse mutable bindings or choose new names. Await tools and cleanup before returning; unfinished tools reject. After completion, timeout, or cancellation, new tool calls are rejected and output is discarded; background work may still change state. Capture and print child-process output explicitly. Each program starts in the Session's current directory. Running programs keep their initial directory. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
       "parameters": {
         "type": "object",
         "properties": {

snapshots/session/ptc-reset/session.v4.jsonl

@@ -30,12 +30,12 @@
 {"type":"step/start","data":{"turn":1,"step":3}}
 {"type":"assistant/message","data":{"turn":1,"step":3,"message":{"role":"assistant","content":[{"type":"tool-call","id":"call_blocked","name":"run_code","arguments":"{\"code\":\"kept.value\",\"description\":\"Check that failed reset blocks code until host recovery\"}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{message:8}}"},"usage":{"inputTokens":10,"outputTokens":5},"stream":[{"type":"chunk","time":1793281642459,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":1793281642459,"index":0,"dt":[],"id":"call_blocked","name":"run_code","args":["{\"code\":\"kept.value\",\"description\":\"Check that failed reset blocks code until host recovery\"}"]},{"type":"chunk","time":1793281642459,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"call_blocked","name":"run_code","arguments":"{\"code\":\"kept.value\",\"description\":\"Check that failed reset blocks code until host recovery\"}"}}},{"type":"chunk","time":1793281642459,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":5}}},{"type":"chunk","time":1793281642459,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
 {"type":"tool/call","data":{"turn":1,"step":3,"callId":"call_blocked","name":"run_code","arguments":"{\"code\":\"kept.value\",\"description\":\"Check that failed reset blocks code until host recovery\"}"}}
-{"type":"agent/inbox/spliced","data":{"target":"next-step","start":0,"inserted":[{"content":[{"type":"text","text":"The host reset the program environment. All retained variables have been cleared. The next run_code starts fresh. Completed tool effects have not been undone."}],"source":{"kind":"ptc-mode"},"role":"user","id":"{{message:9}}"}]}}
-{"type":"tool/result","data":{"turn":1,"step":3,"message":{"role":"tool","source":{"kind":"tool","callId":"call_blocked"},"toolCallId":"call_blocked","content":[{"type":"text","text":"Error: Program environment is unavailable after a failed host reset: fixture process cleanup failed. State may not be cleared; ask the host to retry reset before running more code."}],"isError":true,"id":"{{message:10}}"},"error":{"name":"CodeRunFailedError","code":"CODE_RUN_FAILED"}},"sourceEventSeqs":[30],"surfaceOp":"append"}
+{"type":"agent/inbox/spliced","data":{"target":"next-step","start":0,"inserted":[{"content":[{"type":"text","text":"Program environment reset; retained variables cleared. Completed tool effects remain."}],"source":{"kind":"ptc-mode"},"role":"user","id":"{{message:9}}"}]}}
+{"type":"tool/result","data":{"turn":1,"step":3,"message":{"role":"tool","source":{"kind":"tool","callId":"call_blocked"},"toolCallId":"call_blocked","content":[{"type":"text","text":"Error: Program environment unavailable: fixture process cleanup failed. Ask the host to reset it before running more code."}],"isError":true,"id":"{{message:10}}"},"error":{"name":"CodeRunFailedError","code":"CODE_RUN_FAILED"}},"sourceEventSeqs":[30],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":3}}
 {"type":"agent/inbox/spliced","data":{"target":"next-step","start":0,"removedCount":1,"inserted":[]}}
 {"type":"step/start","data":{"turn":1,"step":4}}
-{"type":"user/message","data":{"content":[{"type":"text","text":"The host reset the program environment. All retained variables have been cleared. The next run_code starts fresh. Completed tool effects have not been undone."}],"source":{"kind":"ptc-mode"},"role":"user","id":"{{message:9}}"},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Program environment reset; retained variables cleared. Completed tool effects remain."}],"source":{"kind":"ptc-mode"},"role":"user","id":"{{message:9}}"},"surfaceOp":"append"}
 {"type":"assistant/message","data":{"turn":1,"step":4,"message":{"role":"assistant","content":[{"type":"tool-call","id":"call_check","name":"run_code","arguments":"{\"code\":\"({ retained: typeof kept, file: (await tools.bash({ command: \\\"cat kept.txt\\\", description: \\\"Read the saved value after reset\\\" })).stdout.text.trim() })\",\"description\":\"Check cleared variables and completed file effects\"}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{message:11}}"},"usage":{"inputTokens":10,"outputTokens":5},"stream":[{"type":"chunk","time":1793281642493,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":1793281642493,"index":0,"dt":[],"id":"call_check","name":"run_code","args":["{\"code\":\"({ retained: typeof kept, file: (await tools.bash({ command: \\\"cat kept.txt\\\", description: \\\"Read the saved value after reset\\\" })).stdout.text.trim() })\",\"description\":\"Check cleared variables and completed file effects\"}"]},{"type":"chunk","time":1793281642493,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"call_check","name":"run_code","arguments":"{\"code\":\"({ retained: typeof kept, file: (await tools.bash({ command: \\\"cat kept.txt\\\", description: \\\"Read the saved value after reset\\\" })).stdout.text.trim() })\",\"description\":\"Check cleared variables and completed file effects\"}"}}},{"type":"chunk","time":1793281642493,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":5}}},{"type":"chunk","time":1793281642493,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
 {"type":"tool/call","data":{"turn":1,"step":4,"callId":"call_check","name":"run_code","arguments":"{\"code\":\"({ retained: typeof kept, file: (await tools.bash({ command: \\\"cat kept.txt\\\", description: \\\"Read the saved value after reset\\\" })).stdout.text.trim() })\",\"description\":\"Check cleared variables and completed file effects\"}"}}
 {"type":"tool/ptc-dispatch-start","data":{"rootCallId":"call_check","parentCallId":"call_check","subCallId":"call_check:ptc:1","name":"bash","arguments":{"command":"cat kept.txt","description":"Read the saved value after reset"}}}

snapshots/session/ptc-reset/tool-schemas.expected.json

@@ -2,7 +2,7 @@
   "initial": [
     {
       "name": "run_code",
-      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the program to execute, and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Curate the program output. Image-bearing subtool results are attached after the run. The program contains TypeScript script statements; only erasable syntax is accepted, with no enum or namespaces. Type annotations are advisory. Top-level declarations and await are supported; top-level return is not supported. Emit output with console.log(...) or a final lossless JSON expression. The final expression is awaited if it is a Promise. Only printed values and that final expression become program output. Variables, functions, and imported modules remain in memory for this Agent across calls. Use await import(...) for modules. Relative paths use the supplied working directory. Direct filesystem access follows this execution's sandbox policy; process.env starts empty. Await asynchronous work: an uncaught callback exception or unhandled rejection terminates the process and clears its variables. Values from bindings and imports can belong to another realm; use Array.isArray for arrays and the supplied binding error classes for failures, because instanceof Array or Error may be false. Changing the session sandbox mode clears retained variables. An approved sandbox escalation runs in a separate temporary environment: it cannot access retained variables, and its declarations are discarded afterward. Restart, Agent disposal, output overflow, or process failure clears the environment. Timeout and cancellation request cooperative stop: retained variables survive if the runtime acknowledges; otherwise the host terminates the process and clears them. Earlier mutations are not rolled back. If a variable is undefined, recreate it and reacquire its resources. State is not restored from the conversation, and failed evaluations can leave earlier mutations in memory. Redeclaring an existing let, const, or class name fails; assign to a mutable binding or use a new name. Await all tool calls and required cleanup before returning; unfinished tool calls reject when the evaluation ends or is canceled, so catch and finally handlers can run. Output produced after a stop request is discarded, including output from catch and finally handlers. Background callbacks cannot call tools or emit captured output after their evaluation ends; unmanaged asynchronous work may still mutate retained variables. Collect child-process output explicitly and print it; inherited native stdout/stderr is excluded from retained execution output. If a native top-level let, const, or class initializer throws, its name may remain permanently uninitialized; use a new name or restart the environment. Each program starts in the Session's current directory. Running programs keep their initial directory. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
+      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the program to execute, and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Curate the program output. Image-bearing subtool results are attached after the run. The program contains TypeScript script statements; only erasable syntax is accepted, with no enum or namespaces. Type annotations are advisory. Top-level declarations and await are supported; top-level return is not supported. Emit output with console.log(...) or a final lossless JSON expression. The final expression is awaited if it is a Promise. Only printed values and that final expression become program output. Variables, functions, and imported modules remain in memory for this Agent across calls. Use await import(...) for modules. Relative paths use the supplied working directory. Direct filesystem access follows this execution's sandbox policy; process.env starts empty. Await asynchronous work: an uncaught callback exception or unhandled rejection terminates the process and clears its variables. Values from bindings and imports can belong to another realm; use Array.isArray for arrays and the supplied binding error classes for failures, because instanceof Array or Error may be false. Timeout and cancellation results say whether retained variables were preserved or cleared. Restart, sandbox changes, output overflow, or process failure clears them. Recreate missing variables and resources; conversation history does not restore state. Earlier mutations and tool effects are not rolled back. Approved sandbox escalations use a fresh environment and discard its variables afterward. Do not redeclare existing let, const, or class names; reuse mutable bindings or choose new names. Await tools and cleanup before returning; unfinished tools reject. After completion, timeout, or cancellation, new tool calls are rejected and output is discarded; background work may still change state. Capture and print child-process output explicitly. If a native top-level let, const, or class initializer throws, its name may remain permanently uninitialized; use a new name or restart the environment. Each program starts in the Session's current directory. Running programs keep their initial directory. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
       "parameters": {
         "type": "object",
         "properties": {

snapshots/session/ptc-script-retained/tool-schemas.expected.json

@@ -2,7 +2,7 @@
   "initial": [
     {
       "name": "run_code",
-      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the program to execute, and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Curate the program output. Image-bearing subtool results are attached after the run. The program contains TypeScript script statements; only erasable syntax is accepted, with no enum or namespaces. Type annotations are advisory. Top-level declarations and await are supported; top-level return is not supported. Emit output with console.log(...) or a final lossless JSON expression. The final expression is awaited if it is a Promise. Only printed values and that final expression become program output. Variables, functions, and imported modules remain in memory for this Agent across calls. Use await import(...) for modules. Relative paths use the supplied working directory. Direct filesystem access follows this execution's sandbox policy; process.env starts empty. Await asynchronous work: an uncaught callback exception or unhandled rejection terminates the process and clears its variables. Values from bindings and imports can belong to another realm; use Array.isArray for arrays and the supplied binding error classes for failures, because instanceof Array or Error may be false. Changing the session sandbox mode clears retained variables. An approved sandbox escalation runs in a separate temporary environment: it cannot access retained variables, and its declarations are discarded afterward. Restart, Agent disposal, output overflow, or process failure clears the environment. Timeout and cancellation request cooperative stop: retained variables survive if the runtime acknowledges; otherwise the host terminates the process and clears them. Earlier mutations are not rolled back. If a variable is undefined, recreate it and reacquire its resources. State is not restored from the conversation, and failed evaluations can leave earlier mutations in memory. Redeclaring an existing let, const, or class name fails; assign to a mutable binding or use a new name. Await all tool calls and required cleanup before returning; unfinished tool calls reject when the evaluation ends or is canceled, so catch and finally handlers can run. Output produced after a stop request is discarded, including output from catch and finally handlers. Background callbacks cannot call tools or emit captured output after their evaluation ends; unmanaged asynchronous work may still mutate retained variables. Collect child-process output explicitly and print it; inherited native stdout/stderr is excluded from retained execution output. If a native top-level let, const, or class initializer throws, its name may remain permanently uninitialized; use a new name or restart the environment. Each program starts in the Session's current directory. Running programs keep their initial directory. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
+      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the program to execute, and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Curate the program output. Image-bearing subtool results are attached after the run. The program contains TypeScript script statements; only erasable syntax is accepted, with no enum or namespaces. Type annotations are advisory. Top-level declarations and await are supported; top-level return is not supported. Emit output with console.log(...) or a final lossless JSON expression. The final expression is awaited if it is a Promise. Only printed values and that final expression become program output. Variables, functions, and imported modules remain in memory for this Agent across calls. Use await import(...) for modules. Relative paths use the supplied working directory. Direct filesystem access follows this execution's sandbox policy; process.env starts empty. Await asynchronous work: an uncaught callback exception or unhandled rejection terminates the process and clears its variables. Values from bindings and imports can belong to another realm; use Array.isArray for arrays and the supplied binding error classes for failures, because instanceof Array or Error may be false. Timeout and cancellation results say whether retained variables were preserved or cleared. Restart, sandbox changes, output overflow, or process failure clears them. Recreate missing variables and resources; conversation history does not restore state. Earlier mutations and tool effects are not rolled back. Approved sandbox escalations use a fresh environment and discard its variables afterward. Do not redeclare existing let, const, or class names; reuse mutable bindings or choose new names. Await tools and cleanup before returning; unfinished tools reject. After completion, timeout, or cancellation, new tool calls are rejected and output is discarded; background work may still change state. Capture and print child-process output explicitly. If a native top-level let, const, or class initializer throws, its name may remain permanently uninitialized; use a new name or restart the environment. Each program starts in the Session's current directory. Running programs keep their initial directory. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
       "parameters": {
         "type": "object",
         "properties": {

snapshots/session/ptc-timeout-fallback/session.v4.jsonl

@@ -19,7 +19,7 @@
 {"type":"step/start","data":{"turn":1,"step":2}}
 {"type":"assistant/message","data":{"turn":1,"step":2,"message":{"role":"assistant","content":[{"type":"tool-call","id":"call_timeout","name":"run_code","arguments":"{\"code\":\"console.log(\\\"output before timeout\\\"); while (true) {}\",\"description\":\"Print partial output before an infinite loop\"}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{message:6}}"},"usage":{"inputTokens":10,"outputTokens":5},"stream":[{"type":"chunk","time":1793255395835,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":1793255395835,"index":0,"dt":[],"id":"call_timeout","name":"run_code","args":["{\"code\":\"console.log(\\\"output before timeout\\\"); while (true) {}\",\"description\":\"Print partial output before an infinite loop\"}"]},{"type":"chunk","time":1793255395835,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"call_timeout","name":"run_code","arguments":"{\"code\":\"console.log(\\\"output before timeout\\\"); while (true) {}\",\"description\":\"Print partial output before an infinite loop\"}"}}},{"type":"chunk","time":1793255395835,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":5}}},{"type":"chunk","time":1793255395835,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
 {"type":"tool/call","data":{"turn":1,"step":2,"callId":"call_timeout","name":"run_code","arguments":"{\"code\":\"console.log(\\\"output before timeout\\\"); while (true) {}\",\"description\":\"Print partial output before an infinite loop\"}"}}
-{"type":"tool/result","data":{"turn":1,"step":2,"message":{"role":"tool","source":{"kind":"tool","callId":"call_timeout"},"toolCallId":"call_timeout","content":[{"type":"text","text":"Error: code run failed (timeout): execution timed out during execution (10000ms); runtime did not confirm stopping; runtime terminated; retained variables were cleared\nCaptured output:\noutput before timeout\nFile sandbox: workspace-write; enforcement: full."}],"isError":true,"id":"{{message:7}}"},"error":{"name":"CodeRunFailedError","code":"CODE_RUN_FAILED"}},"sourceEventSeqs":[19],"surfaceOp":"append"}
+{"type":"tool/result","data":{"turn":1,"step":2,"message":{"role":"tool","source":{"kind":"tool","callId":"call_timeout"},"toolCallId":"call_timeout","content":[{"type":"text","text":"Error: code run failed (timeout): execution timed out during execution (10000ms); retained variables were cleared\nCaptured output:\noutput before timeout\nFile sandbox: workspace-write; enforcement: full."}],"isError":true,"id":"{{message:7}}"},"error":{"name":"CodeRunFailedError","code":"CODE_RUN_FAILED"}},"sourceEventSeqs":[19],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":2}}
 {"type":"step/start","data":{"turn":1,"step":3}}
 {"type":"assistant/message","data":{"turn":1,"step":3,"message":{"role":"assistant","content":[{"type":"tool-call","id":"call_check","name":"run_code","arguments":"{\"code\":\"({ retained: typeof kept })\",\"description\":\"Check retained variables after execution times out\"}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash"},"id":"{{message:8}}"},"usage":{"inputTokens":10,"outputTokens":5},"stream":[{"type":"chunk","time":1793255405869,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"tool-call-chunks","time0":1793255405869,"index":0,"dt":[],"id":"call_check","name":"run_code","args":["{\"code\":\"({ retained: typeof kept })\",\"description\":\"Check retained variables after execution times out\"}"]},{"type":"chunk","time":1793255405869,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"call_check","name":"run_code","arguments":"{\"code\":\"({ retained: typeof kept })\",\"description\":\"Check retained variables after execution times out\"}"}}},{"type":"chunk","time":1793255405869,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":5}}},{"type":"chunk","time":1793255405869,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}

snapshots/session/ptc-timeout-fallback/tool-schemas.expected.json

@@ -2,7 +2,7 @@
   "initial": [
     {
       "name": "run_code",
-      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the program to execute, and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Curate the program output. Image-bearing subtool results are attached after the run. The program contains TypeScript script statements; only erasable syntax is accepted, with no enum or namespaces. Type annotations are advisory. Top-level declarations and await are supported; top-level return is not supported. Emit output with console.log(...) or a final lossless JSON expression. The final expression is awaited if it is a Promise. Only printed values and that final expression become program output. Variables, functions, and imported modules remain in memory for this Agent across calls. Use await import(...) for modules. Relative paths use the supplied working directory. Direct filesystem access follows this execution's sandbox policy; process.env starts empty. Await asynchronous work: an uncaught callback exception or unhandled rejection terminates the process and clears its variables. Values from bindings and imports can belong to another realm; use Array.isArray for arrays and the supplied binding error classes for failures, because instanceof Array or Error may be false. Changing the session sandbox mode clears retained variables. An approved sandbox escalation runs in a separate temporary environment: it cannot access retained variables, and its declarations are discarded afterward. Restart, Agent disposal, output overflow, or process failure clears the environment. Timeout and cancellation request cooperative stop: retained variables survive if the runtime acknowledges; otherwise the host terminates the process and clears them. Earlier mutations are not rolled back. If a variable is undefined, recreate it and reacquire its resources. State is not restored from the conversation, and failed evaluations can leave earlier mutations in memory. Redeclaring an existing let, const, or class name fails; assign to a mutable binding or use a new name. Await all tool calls and required cleanup before returning; unfinished tool calls reject when the evaluation ends or is canceled, so catch and finally handlers can run. Output produced after a stop request is discarded, including output from catch and finally handlers. Background callbacks cannot call tools or emit captured output after their evaluation ends; unmanaged asynchronous work may still mutate retained variables. Collect child-process output explicitly and print it; inherited native stdout/stderr is excluded from retained execution output. If a native top-level let, const, or class initializer throws, its name may remain permanently uninitialized; use a new name or restart the environment. Each program starts in the Session's current directory. Running programs keep their initial directory. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
+      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the program to execute, and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Curate the program output. Image-bearing subtool results are attached after the run. The program contains TypeScript script statements; only erasable syntax is accepted, with no enum or namespaces. Type annotations are advisory. Top-level declarations and await are supported; top-level return is not supported. Emit output with console.log(...) or a final lossless JSON expression. The final expression is awaited if it is a Promise. Only printed values and that final expression become program output. Variables, functions, and imported modules remain in memory for this Agent across calls. Use await import(...) for modules. Relative paths use the supplied working directory. Direct filesystem access follows this execution's sandbox policy; process.env starts empty. Await asynchronous work: an uncaught callback exception or unhandled rejection terminates the process and clears its variables. Values from bindings and imports can belong to another realm; use Array.isArray for arrays and the supplied binding error classes for failures, because instanceof Array or Error may be false. Timeout and cancellation results say whether retained variables were preserved or cleared. Restart, sandbox changes, output overflow, or process failure clears them. Recreate missing variables and resources; conversation history does not restore state. Earlier mutations and tool effects are not rolled back. Approved sandbox escalations use a fresh environment and discard its variables afterward. Do not redeclare existing let, const, or class names; reuse mutable bindings or choose new names. Await tools and cleanup before returning; unfinished tools reject. After completion, timeout, or cancellation, new tool calls are rejected and output is discarded; background work may still change state. Capture and print child-process output explicitly. If a native top-level let, const, or class initializer throws, its name may remain permanently uninitialized; use a new name or restart the environment. Each program starts in the Session's current directory. Running programs keep their initial directory. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
       "parameters": {
         "type": "object",
         "properties": {

snapshots/session/ptc-timeout/tool-schemas.expected.json

@@ -2,7 +2,7 @@
   "initial": [
     {
       "name": "run_code",
-      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the program to execute, and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Curate the program output. Image-bearing subtool results are attached after the run. The program contains TypeScript script statements; only erasable syntax is accepted, with no enum or namespaces. Type annotations are advisory. Top-level declarations and await are supported; top-level return is not supported. Emit output with console.log(...) or a final lossless JSON expression. The final expression is awaited if it is a Promise. Only printed values and that final expression become program output. Variables, functions, and imported modules remain in memory for this Agent across calls. Use await import(...) for modules. Relative paths use the supplied working directory. Direct filesystem access follows this execution's sandbox policy; process.env starts empty. Await asynchronous work: an uncaught callback exception or unhandled rejection terminates the process and clears its variables. Values from bindings and imports can belong to another realm; use Array.isArray for arrays and the supplied binding error classes for failures, because instanceof Array or Error may be false. Changing the session sandbox mode clears retained variables. An approved sandbox escalation runs in a separate temporary environment: it cannot access retained variables, and its declarations are discarded afterward. Restart, Agent disposal, output overflow, or process failure clears the environment. Timeout and cancellation request cooperative stop: retained variables survive if the runtime acknowledges; otherwise the host terminates the process and clears them. Earlier mutations are not rolled back. If a variable is undefined, recreate it and reacquire its resources. State is not restored from the conversation, and failed evaluations can leave earlier mutations in memory. Redeclaring an existing let, const, or class name fails; assign to a mutable binding or use a new name. Await all tool calls and required cleanup before returning; unfinished tool calls reject when the evaluation ends or is canceled, so catch and finally handlers can run. Output produced after a stop request is discarded, including output from catch and finally handlers. Background callbacks cannot call tools or emit captured output after their evaluation ends; unmanaged asynchronous work may still mutate retained variables. Collect child-process output explicitly and print it; inherited native stdout/stderr is excluded from retained execution output. If a native top-level let, const, or class initializer throws, its name may remain permanently uninitialized; use a new name or restart the environment. Each program starts in the Session's current directory. Running programs keep their initial directory. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
+      "description": "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the program to execute, and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Curate the program output. Image-bearing subtool results are attached after the run. The program contains TypeScript script statements; only erasable syntax is accepted, with no enum or namespaces. Type annotations are advisory. Top-level declarations and await are supported; top-level return is not supported. Emit output with console.log(...) or a final lossless JSON expression. The final expression is awaited if it is a Promise. Only printed values and that final expression become program output. Variables, functions, and imported modules remain in memory for this Agent across calls. Use await import(...) for modules. Relative paths use the supplied working directory. Direct filesystem access follows this execution's sandbox policy; process.env starts empty. Await asynchronous work: an uncaught callback exception or unhandled rejection terminates the process and clears its variables. Values from bindings and imports can belong to another realm; use Array.isArray for arrays and the supplied binding error classes for failures, because instanceof Array or Error may be false. Timeout and cancellation results say whether retained variables were preserved or cleared. Restart, sandbox changes, output overflow, or process failure clears them. Recreate missing variables and resources; conversation history does not restore state. Earlier mutations and tool effects are not rolled back. Approved sandbox escalations use a fresh environment and discard its variables afterward. Do not redeclare existing let, const, or class names; reuse mutable bindings or choose new names. Await tools and cleanup before returning; unfinished tools reject. After completion, timeout, or cancellation, new tool calls are rejected and output is discarded; background work may still change state. Capture and print child-process output explicitly. If a native top-level let, const, or class initializer throws, its name may remain permanently uninitialized; use a new name or restart the environment. Each program starts in the Session's current directory. Running programs keep their initial directory. A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.",
       "parameters": {
         "type": "object",
         "properties": {