@cognipeer/agent-sdk 0.10.1 → 0.10.3

package/dist/index.cjs

@@ -4601,18 +4601,60 @@ function createToolsNode(initialTools, opts) {
         toolStateRef.__currentToolCallId = toolCallId;
         delete toolStateRef.__awaitingApproval;
       }
-      let hookAskedForApproval = false;
-      let hookApprovalPrompt;
-      let hookResult;
-      if (host?.has("preToolUse")) {
+      const stableJson = (value) => {
+        try {
+          if (value === null || typeof value !== "object") return JSON.stringify(value);
+          if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+          const keys = Object.keys(value).sort();
+          return `{${keys.map((k) => JSON.stringify(k) + ":" + stableJson(value[k])).join(",")}}`;
+        } catch {
+          return String(value);
+        }
+      };
+      const rejectByPolicy = (gateReason, gatedArgs) => {
+        const reason = gateReason || `Tool call blocked by policy: ${toolName}`;
+        push({ role: "tool", content: reason, tool_call_id: toolCallId, name: tc.name });
+        toolHistory.push({
+          executionId: nanoid.nanoid(),
+          toolName,
+          args: gatedArgs,
+          output: reason,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          tool_call_id: toolCallId,
+          status: "rejected"
+        });
+        onEvent?.({ type: "tool_call", phase: "skipped", name: toolName, id: tc.id, args: gatedArgs, error: { message: reason } });
+        recordTraceEvent(traceSession, {
+          type: "tool_call",
+          label: `Tool Denied - ${toolName}`,
+          actor: { scope: "tool", name: toolName, role: "tool" },
+          status: "skipped",
+          toolDetails,
+          toolExecutionId: toolCallId,
+          sections: buildToolTraceSections({
+            args: gatedArgs,
+            executionId: toolCallId,
+            output: reason,
+            status: "skipped",
+            summary: reason,
+            toolDetails,
+            toolName
+          })
+        });
+        toolCount += 1;
+        return { status: "error" };
+      };
+      const applyPreToolUseGate = async (candidate) => {
+        if (!host?.has("preToolUse")) return { ok: true, args: candidate, ask: false };
         const gate = await host.runGate("preToolUse", {
           toolName,
           toolCallId,
-          args,
+          args: candidate,
           tool,
           executionCount: countSuccessfulToolExecutions(toolHistory, toolName)
         });
-        if (gate.input.args !== args) {
+        let next = candidate;
+        if (gate.input.args !== candidate) {
           const revalidated = validateToolArgs(tool, gate.input.args);
           if (!revalidated.ok && resolved.toolResponses.schemaValidation === "strict") {
             const message = `Tool argument validation failed after a plugin rewrite for ${toolName}: ${revalidated.message}`;
@@ -4620,48 +4662,31 @@ function createToolsNode(initialTools, opts) {
             markToolFailure(message, toolName, toolCallId);
             onEvent?.({ type: "tool_call", phase: "error", name: toolName, id: tc.id, args: gate.input.args, error: { message } });
             toolCount += 1;
-            return { status: "error" };
+            return { ok: false, outcome: { status: "error" } };
           }
-          args = revalidated.ok ? revalidated.value : gate.input.args;
+          next = revalidated.ok ? revalidated.value : gate.input.args;
         }
         if (gate.decision === "deny") {
-          const reason = gate.reason || `Tool call blocked by policy: ${toolName}`;
-          push({ role: "tool", content: reason, tool_call_id: toolCallId, name: tc.name });
-          toolHistory.push({
-            executionId: nanoid.nanoid(),
-            toolName,
-            args,
-            output: reason,
-            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-            tool_call_id: toolCallId,
-            status: "rejected"
-          });
-          onEvent?.({ type: "tool_call", phase: "skipped", name: toolName, id: tc.id, args, error: { message: reason } });
-          recordTraceEvent(traceSession, {
-            type: "tool_call",
-            label: `Tool Denied - ${toolName}`,
-            actor: { scope: "tool", name: toolName, role: "tool" },
-            status: "skipped",
-            toolDetails,
-            toolExecutionId: toolCallId,
-            sections: buildToolTraceSections({
-              args,
-              executionId: toolCallId,
-              output: reason,
-              status: "skipped",
-              summary: reason,
-              toolDetails,
-              toolName
-            })
-          });
-          toolCount += 1;
-          return { status: "error" };
-        }
-        if (gate.decision === "ask") {
-          hookAskedForApproval = true;
-          hookApprovalPrompt = gate.approvalPrompt;
+          return { ok: false, outcome: rejectByPolicy(gate.reason, next) };
         }
-        if (gate.shortCircuit !== void 0) hookResult = gate.shortCircuit;
+        return {
+          ok: true,
+          args: next,
+          ask: gate.decision === "ask",
+          approvalPrompt: gate.approvalPrompt,
+          result: gate.shortCircuit
+        };
+      };
+      let hookAskedForApproval = false;
+      let hookApprovalPrompt;
+      let hookResult;
+      {
+        const gated = await applyPreToolUseGate(args);
+        if (!gated.ok) return gated.outcome;
+        args = gated.args;
+        hookAskedForApproval = gated.ask;
+        hookApprovalPrompt = gated.approvalPrompt;
+        if (gated.result !== void 0) hookResult = gated.result;
       }
       const maxExecutionsPerRun = normalizeMaxExecutionsPerRun(tool.maxExecutionsPerRun);
       if (maxExecutionsPerRun !== null) {
@@ -4746,7 +4771,34 @@ function createToolsNode(initialTools, opts) {
           return { status: "rejected", approval: approvalEntry };
         }
         if (approvalEntry.status === "approved" && approvalEntry.approvedArgs !== void 0) {
-          args = approvalEntry.approvedArgs;
+          const approvedArgs = approvalEntry.approvedArgs;
+          if (stableJson(approvedArgs) !== stableJson(args)) {
+            const settleRefused = (resolution) => {
+              approvalEntry.metadata = { ...approvalEntry.metadata || {}, resolution };
+              approvalEntry.status = "executed";
+              approvalEntry.resolvedAt = (/* @__PURE__ */ new Date()).toISOString();
+              pendingByCallId.set(toolCallId, approvalEntry);
+            };
+            const revalidated = validateToolArgs(tool, approvedArgs);
+            if (!revalidated.ok && resolved.toolResponses.schemaValidation === "strict") {
+              const message = `Tool argument validation failed for reviewer-edited arguments of ${toolName}: ${revalidated.message}`;
+              push({ role: "tool", content: message, tool_call_id: toolCallId, name: tc.name });
+              markToolFailure(message, toolName, toolCallId);
+              settleRefused("invalid_args");
+              onEvent?.({ type: "tool_call", phase: "error", name: toolName, id: tc.id, args: approvedArgs, error: { message } });
+              toolCount += 1;
+              return { status: "error", approval: approvalEntry };
+            }
+            const gated = await applyPreToolUseGate(revalidated.ok ? revalidated.value : approvedArgs);
+            if (!gated.ok) {
+              settleRefused("policy_denied");
+              return { ...gated.outcome, approval: approvalEntry };
+            }
+            args = gated.args;
+            if (gated.result !== void 0 && hookResult === void 0) hookResult = gated.result;
+          } else {
+            args = approvedArgs;
+          }
           onEvent?.({ type: "tool_approval", status: "approved", id: approvalEntry.id, toolName: approvalEntry.toolName, toolCallId: approvalEntry.toolCallId, decidedBy: approvalEntry.decidedBy, comment: approvalEntry.comment });
         }
       }
@@ -4756,16 +4808,6 @@ function createToolsNode(initialTools, opts) {
       const cacheCfg = tool.cache;
       const cacheEnabled = cacheCfg === true || cacheCfg && typeof cacheCfg === "object";
       const cacheKeyFn = cacheEnabled && typeof cacheCfg === "object" ? cacheCfg.keyFn : void 0;
-      const stableJson = (value) => {
-        try {
-          if (value === null || typeof value !== "object") return JSON.stringify(value);
-          if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
-          const keys = Object.keys(value).sort();
-          return `{${keys.map((k) => JSON.stringify(k) + ":" + stableJson(value[k])).join(",")}}`;
-        } catch {
-          return String(value);
-        }
-      };
       const cacheKey = cacheEnabled ? `${toolName}|${cacheKeyFn ? cacheKeyFn(args) : stableJson(args)}` : void 0;
       const toolCache = state.toolCache = state.toolCache || {};
       let cachedHit = void 0;
@@ -4813,6 +4855,22 @@ function createToolsNode(initialTools, opts) {
       try {
         if (cachedHit !== void 0) {
           const executionId2 = nanoid.nanoid();
+          if (host?.has("postToolUse")) {
+            const shortGate = await host.runGate("postToolUse", {
+              toolName,
+              toolCallId,
+              args,
+              output: cachedHit,
+              durationMs: 0,
+              executionId: executionId2,
+              source: shortCircuitSource === "plugin" ? "hook" : "cache"
+            });
+            if (shortGate.decision === "deny") {
+              cachedHit = shortGate.reason || `Tool output withheld by policy: ${toolName}`;
+            } else if (shortGate.input.output !== cachedHit) {
+              cachedHit = shortGate.input.output;
+            }
+          }
           const { output: compressedCachedHit, stats: cachedContextPilotStats } = maybeCompressToolOutput(toolName, cachedHit, executionId2);
           const responsePolicy2 = applyToolResponseHardCap(toolName, compressedCachedHit, executionId2, resolved);
           toolHistory.push({
@@ -4979,7 +5037,8 @@ function createToolsNode(initialTools, opts) {
             args,
             output,
             durationMs,
-            executionId
+            executionId,
+            source: "tool"
           });
           if (postGate.decision === "deny") {
             output = postGate.reason || `Tool output withheld by policy: ${toolName}`;
@@ -5074,7 +5133,8 @@ function createToolsNode(initialTools, opts) {
               output: message,
               error: error instanceof Error ? error : new Error(message),
               durationMs,
-              executionId
+              executionId,
+              source: "tool"
             });
             if (errorGate.decision === "deny") {
               message = errorGate.reason || `Tool error withheld by policy: ${toolName}`;
@@ -5750,7 +5810,14 @@ var DISALLOWED_CTX_KEYS = /* @__PURE__ */ new Set([
   // Session bookkeeping: a resumed run must open its OWN session, so these
   // must not travel in a snapshot.
   "__pluginRunStarted",
-  "__pluginRunEnded"
+  "__pluginRunEnded",
+  // Set by restoreSnapshot on the way OUT, consumed by the next invoke. Never
+  // persisted: a snapshot of a restored run would otherwise mark every later
+  // restore as "resumed" forever.
+  "__restoredFromSnapshot",
+  // A per-turn verdict. It describes the run that produced the snapshot, not
+  // the run that will resume from it.
+  "__guardrailBlocked"
 ]);
 var clone = (value) => {
   if (typeof globalThis.structuredClone === "function") {
@@ -6089,6 +6156,9 @@ function isSyntheticSummaryMessage(message) {
   }
   return false;
 }
+function isCompactedToolContent(content) {
+  return typeof content === "string" && (content === "SUMMARIZED" || content.startsWith("SUMMARIZED_TOOL_RESPONSE") || content.startsWith("ARCHIVED_TOOL_RESPONSE") || content.startsWith("STRUCTURED_TOOL_RESPONSE") || content.startsWith("DROPPED_TOOL_RESPONSE"));
+}
 
 // src/structuredOutput/manager.ts
 var StructuredOutputManager = class {
@@ -6374,6 +6444,7 @@ var SLOT_NAMES = [
   "contextBuilder"
 ];
 var DECISION_RANK = { allow: 0, ask: 1, deny: 2 };
+var isHookDecision = (value) => typeof value === "string" && Object.prototype.hasOwnProperty.call(DECISION_RANK, value);
 function escalate(current, next) {
   return DECISION_RANK[next] > DECISION_RANK[current] ? next : current;
 }
@@ -6383,6 +6454,15 @@ var HookTimeoutError = class extends Error {
     this.name = "HookTimeoutError";
   }
 };
+var InvalidHookDecisionError = class extends Error {
+  constructor(plugin, hook, value) {
+    const shown = typeof value === "string" ? JSON.stringify(value) : String(value);
+    super(
+      `plugin "${plugin}" hook "${hook}" returned an unknown decision ${shown}; expected "allow", "ask" or "deny"`
+    );
+    this.name = "InvalidHookDecisionError";
+  }
+};
 function withTimeout(value, ms, label) {
   if (!ms || !Number.isFinite(ms) || ms <= 0) return Promise.resolve(value);
   return new Promise((resolve, reject) => {
@@ -6672,10 +6752,18 @@ function createPluginHost(plugins = [], options = {}) {
                 `plugin "${entry.plugin}" hook "${hook}"`
               );
               output = raw ?? void 0;
+              if (output && typeof output === "object" && output.decision !== void 0 && !isHookDecision(output.decision)) {
+                throw new InvalidHookDecisionError(entry.plugin, hook, output.decision);
+              }
             } catch (err) {
               const message = err instanceof Error ? err.message : String(err);
               const timedOut = err instanceof HookTimeoutError;
-              logger.warn(`plugin "${entry.plugin}" hook "${hook}" failed:`, message);
+              const badDecision = err instanceof InvalidHookDecisionError;
+              if (badDecision) {
+                logger.error(`plugin "${entry.plugin}" hook "${hook}" returned an invalid decision:`, message);
+              } else {
+                logger.warn(`plugin "${entry.plugin}" hook "${hook}" failed:`, message);
+              }
               emitPluginEvent(entry, hook, {
                 phase: timedOut ? "timeout" : "error",
                 error: { message },
@@ -6687,8 +6775,9 @@ function createPluginHost(plugins = [], options = {}) {
                 durationMs: performanceNow() - startedAt
               });
               if (entry.failureMode === "closed") {
+                const cause = timedOut ? "timed out" : badDecision ? "invalid decision" : "hook error";
                 result.decision = "deny";
-                result.reason = `${entry.plugin}: ${timedOut ? "timed out" : "hook error"} (fail-closed) \u2014 ${message}`;
+                result.reason = `${entry.plugin}: ${cause} (fail-closed) \u2014 ${message}`;
                 result.deniedBy = entry.plugin;
                 result.input = current;
                 return result;
@@ -6746,11 +6835,19 @@ function createPluginHost(plugins = [], options = {}) {
             if (output.metadata && typeof output.metadata === "object") {
               result.metadata = { ...result.metadata ?? {}, ...output.metadata };
             }
-            const decision = output.decision;
+            let decision = output.decision;
+            if (decision === "ask" && hook !== "preToolUse") {
+              logger.warn(
+                `plugin "${entry.plugin}" returned "ask" from "${hook}", which cannot pause for approval; treating it as "deny".`
+              );
+              decision = "deny";
+            }
             const escalated = decision ? escalate(result.decision, decision) : result.decision;
             const escalatesHere = escalated !== result.decision;
             result.decision = escalated;
-            if (typeof output.reason === "string" && (escalatesHere || !result.reason)) {
+            if (escalatesHere) {
+              result.reason = typeof output.reason === "string" ? `${entry.plugin}: ${output.reason}` : void 0;
+            } else if (typeof output.reason === "string" && !result.reason) {
               result.reason = `${entry.plugin}: ${output.reason}`;
             }
             if (mutatedHere) {
@@ -6844,7 +6941,7 @@ async function openPluginSession(runHost, params) {
   const appended = startGate.collected.systemPromptAppend ?? [];
   const systemPromptAppend = appended.length > 0 ? appended.join("\n\n") : void 0;
   const last = messages[messages.length - 1];
-  if (params.resumed || last?.role !== "user" || !runHost.has("userPromptSubmit")) {
+  if (params.pausedMidRun || last?.role !== "user" || !runHost.has("userPromptSubmit")) {
     return { messages, systemPromptAppend };
   }
   const content = last.content;
@@ -7089,6 +7186,11 @@ function createAgent(opts) {
       delete nextCtx.__paused;
       state = { ...state, ctx: Object.keys(nextCtx).length > 0 ? nextCtx : void 0 };
     }
+    if (state.ctx?.__restoredFromSnapshot) {
+      const nextCtx = { ...state.ctx };
+      delete nextCtx.__restoredFromSnapshot;
+      state = { ...state, ctx: Object.keys(nextCtx).length > 0 ? nextCtx : void 0 };
+    }
     let resumeStage = null;
     if (state.ctx?.__resumeStage) {
       const nextCtx = { ...state.ctx };
@@ -7363,7 +7465,7 @@ function createAgent(opts) {
         continue;
       }
       if (toolCalls.length === 0) {
-        if (soManager && !state.ctx?.__finalizedDueToStructuredOutput && !state.ctx?.__structuredOutputForceFinalize) {
+        if (soManager && !state.ctx?.__finalizedDueToStructuredOutput && !state.ctx?.__structuredOutputForceFinalize && !state.ctx?.__guardrailBlocked) {
           if (soManager.strategy.kind === "native") {
             const assistantText = extractMessageText2(lastMsg);
             if (assistantText) {
@@ -7532,6 +7634,7 @@ function createAgent(opts) {
     delete ctx.__plugins;
     delete ctx.__applySystemPromptContribution;
     delete ctx.__pluginState;
+    delete ctx.__guardrailBlocked;
     const inheritedSession = config?.__pluginSession;
     ctx.__runId = inheritedSession?.runId ?? traceSession?.sessionId ?? `run_${nanoid.nanoid(10)}`;
     const stateHolder = inheritedSession?.stateHolder ?? { value: void 0 };
@@ -7581,9 +7684,11 @@ function createAgent(opts) {
       usage: input.usage || { perRequest: [], totals: {} }
     };
     stateHolder.value = initial;
-    const resumed = Boolean(
-      input.ctx?.__restoredFromSnapshot || input.ctx?.__paused || input.ctx?.__resumeStage || input.ctx?.__awaitingApproval || input.ctx?.__awaitingUserQuestion
+    const pausedMidRun = Boolean(
+      input.ctx?.__paused || input.ctx?.__resumeStage || input.ctx?.__awaitingApproval || input.ctx?.__awaitingUserQuestion
     );
+    const resumed = Boolean(input.ctx?.__restoredFromSnapshot || pausedMidRun);
+    delete ctx.__restoredFromSnapshot;
     const startedAt = Date.now();
     let sessionEnded = false;
     const endSession = async (status, payload) => {
@@ -7609,6 +7714,7 @@ function createAgent(opts) {
       const opened = await openPluginSession(runHost, {
         messages: initial.messages,
         resumed,
+        pausedMidRun,
         config
       });
       if (opened.messages !== initial.messages) {
@@ -7969,6 +8075,10 @@ function collectRecentTurns(messages, lastTurnsToKeep) {
 function renderStructuredSummary(summary) {
   if (!summary) return "";
   const lines = ["Context summary:"];
+  if (summary.user_directives && summary.user_directives.length > 0) {
+    lines.push("User directives (still in force \u2014 follow them):");
+    lines.push(...summary.user_directives.map((directive) => `- ${directive}`));
+  }
   if (summary.stable_facts.length > 0) {
     lines.push("Stable facts:");
     lines.push(...summary.stable_facts.map((fact) => `- ${fact.key}: ${fact.value}`));
@@ -8044,17 +8154,46 @@ function clampToBudget(messages, maxContextTokens) {
   }
   return working;
 }
+function collectSummaryOnlyBody(body, hasSummary, lastTurnsToKeep) {
+  if (!hasSummary) {
+    return collectRecentTurns(body, Math.max(1, lastTurnsToKeep));
+  }
+  let boundary = -1;
+  for (let index = body.length - 1; index >= 0; index -= 1) {
+    if (isSyntheticSummaryMessage(body[index])) {
+      boundary = index;
+      break;
+    }
+  }
+  let lastUserIndex = -1;
+  for (let index = body.length - 1; index >= 0; index -= 1) {
+    if (body[index].role === "user") {
+      lastUserIndex = index;
+      break;
+    }
+  }
+  const keep = /* @__PURE__ */ new Set();
+  const firstUserIndex = body.findIndex((message) => message.role === "user");
+  if (firstUserIndex >= 0) keep.add(firstUserIndex);
+  const verbatimFrom = Math.min(lastUserIndex >= 0 ? lastUserIndex : body.length, boundary + 1);
+  for (let index = Math.max(0, verbatimFrom); index < body.length; index += 1) {
+    if (!isSyntheticSummaryMessage(body[index])) keep.add(index);
+  }
+  return body.filter((_, index) => keep.has(index));
+}
 function buildModelMessages(state, config) {
   const rawMessages = state.messages || [];
   if (config.context.policy === "raw") {
     return clampToBudget(rawMessages, config.limits.maxContextTokens);
   }
-  const recentMessages = collectRecentTurns(rawMessages, config.context.lastTurnsToKeep);
   const latestSummary = state.summaryRecords?.[state.summaryRecords.length - 1];
   const summaryText = renderStructuredSummary(latestSummary);
   const memoryText = renderMemoryBlock(state.memoryFacts);
-  const systemMessage2 = recentMessages[0]?.role === "system" ? recentMessages[0] : void 0;
-  const body = systemMessage2 ? recentMessages.slice(1) : recentMessages;
+  const systemMessage2 = rawMessages[0]?.role === "system" ? rawMessages[0] : void 0;
+  const body = config.context.policy === "summary_only" ? collectSummaryOnlyBody(systemMessage2 ? rawMessages.slice(1) : rawMessages, Boolean(summaryText), config.context.lastTurnsToKeep) : (() => {
+    const recentMessages = collectRecentTurns(rawMessages, config.context.lastTurnsToKeep);
+    return recentMessages[0]?.role === "system" ? recentMessages.slice(1) : recentMessages;
+  })();
   const syntheticContextMessages = [];
   if (summaryText) {
     syntheticContextMessages.push({ role: "system", name: "context_summary", content: summaryText });
@@ -8065,7 +8204,7 @@ function buildModelMessages(state, config) {
   const assembled = [
     ...systemMessage2 ? [systemMessage2] : [],
     ...syntheticContextMessages,
-    ...config.context.policy === "summary_only" ? body.filter((message) => message.role === "user" || message.role === "assistant").slice(-2) : body
+    ...body
   ];
   return clampToBudget(assembled, config.limits.maxContextTokens);
 }
@@ -8110,6 +8249,7 @@ function extractJsonObject(text) {
 }
 function normalizeStructuredSummary(input, fallbackText) {
   const summary = {
+    user_directives: Array.isArray(input?.user_directives) ? input.user_directives.map((directive) => String(directive ?? "").trim()).filter(Boolean) : [],
     stable_facts: Array.isArray(input?.stable_facts) ? input.stable_facts.filter((fact) => fact && typeof fact === "object").map((fact) => ({
       key: String(fact.key || "unknown"),
       value: String(fact.value || ""),
@@ -8170,7 +8310,7 @@ function extractCanonicalFacts(messages) {
   return [...facts.values()];
 }
 function isSummarizedToolPlaceholder(content) {
-  return typeof content === "string" && (content === "SUMMARIZED" || content.startsWith("SUMMARIZED_TOOL_RESPONSE") || content.startsWith("ARCHIVED_TOOL_RESPONSE") || content.startsWith("STRUCTURED_TOOL_RESPONSE") || content.startsWith("DROPPED_TOOL_RESPONSE"));
+  return isCompactedToolContent(content);
 }
 function collectLatestTurnToolCallIds(messages) {
   const ids = /* @__PURE__ */ new Set();
@@ -8229,11 +8369,16 @@ function runIntegrityCheck(previous, current) {
   const previousKeys = new Set((previous?.stable_facts || []).map((fact) => fact.key));
   const currentKeys = new Set(current.stable_facts.map((fact) => fact.key));
   const obsoleteKeys = new Set(current.discarded_obsolete);
-  const criticalFactLoss = [...previousKeys].some((key) => !obsoleteKeys.has(key) && !currentKeys.has(key));
+  const currentDirectives = new Set(current.user_directives || []);
+  const lostDirectives = (previous?.user_directives || []).filter((directive) => !currentDirectives.has(directive) && !obsoleteKeys.has(directive));
+  const criticalFactLoss = [...previousKeys].some((key) => !obsoleteKeys.has(key) && !currentKeys.has(key)) || lostDirectives.length > 0;
   const obsoleteFactRevived = current.stable_facts.some((fact) => obsoleteKeys.has(fact.key));
   if (criticalFactLoss) {
     notes.push("Missing previously retained facts; merged forward during integrity repair.");
   }
+  if (lostDirectives.length > 0) {
+    notes.push(`Dropped ${lostDirectives.length} user directive(s); merged forward during integrity repair.`);
+  }
   if (obsoleteFactRevived) {
     notes.push("Obsolete facts reappeared; removed during integrity repair.");
   }
@@ -8256,7 +8401,13 @@ function repairStructuredSummary(previous, current, integrity) {
     }
   }
   const filteredFacts = integrity.obsoleteFactRevived ? nextFacts.filter((fact) => !current.discarded_obsolete.includes(fact.key)) : nextFacts;
-  return { ...current, stable_facts: filteredFacts };
+  const directives = [...current.user_directives || []];
+  for (const directive of previous.user_directives || []) {
+    if (!directives.includes(directive) && !current.discarded_obsolete.includes(directive)) {
+      directives.push(directive);
+    }
+  }
+  return { ...current, user_directives: directives, stable_facts: filteredFacts };
 }
 function createContextSummarizeNode(opts) {
   return async (state) => {
@@ -8330,6 +8481,7 @@ function createContextSummarizeNode(opts) {
 
 Return exactly one JSON object with this schema:
 {
+  "user_directives": [string],
   "stable_facts": [{ "key": string, "value": string, "confidence": number }],
   "active_goals": [string],
   "open_questions": [string],
@@ -8338,6 +8490,7 @@ Return exactly one JSON object with this schema:
 }
 
 Rules:
+- user_directives: standing instructions the user gave about HOW to work or answer for the rest of the conversation (language, format, tone, scope, things to always or never do) that still apply. NOT the tasks or questions themselves \u2014 "read the logs" is a task (an active goal), "always answer in Turkish" is a directive. Copy each directive close to verbatim; never merge, soften or drop one. Carry forward every directive from the previous structured summary unless the user explicitly revoked it \u2014 then put its exact text in discarded_obsolete.
 - Keep stable_facts only for facts that future turns must remember.
 - Put invalidated or superseded fact keys in discarded_obsolete.
 - Preserve active_goals still relevant to the user.
@@ -8405,6 +8558,7 @@ ${canonicalFacts.length > 0 ? canonicalFacts.map((fact) => `- ${fact.key}: ${fac
       durationMs = Date.now() - startTime;
       structuredSummary = normalizeStructuredSummary(void 0, previousSummary || conversationText.slice(0, 800));
       structuredSummary = mergeStableFacts(structuredSummary, canonicalFacts);
+      structuredSummary.user_directives = [...previousStructuredSummary?.user_directives || []];
       integrity = { passed: true, criticalFactLoss: false, obsoleteFactRevived: false, notes: ["Fallback summary generated locally."] };
       summaryText = renderStructuredSummary(structuredSummary);
       const errorEvent = {
@@ -10265,6 +10419,11 @@ ${pluginAppend}`;
   const instance = {
     invoke: async (input, config) => {
       await ensurePluginSetup();
+      if (input?.ctx?.__guardrailBlocked !== void 0) {
+        const clearedCtx = { ...input.ctx };
+        delete clearedCtx.__guardrailBlocked;
+        input = { ...input, ctx: clearedCtx };
+      }
       const sessionHolder = { value: input };
       const emitSessionEvent = (event) => {
         try {
@@ -10315,12 +10474,20 @@ ${pluginAppend}`;
             stateHolder: sessionHolder
           }
         };
-        const resumed = Boolean(
-          input.ctx?.__restoredFromSnapshot || input.ctx?.__paused || input.ctx?.__resumeStage || input.ctx?.__awaitingApproval || input.ctx?.__awaitingUserQuestion
+        const pausedMidRun = Boolean(
+          input.ctx?.__paused || input.ctx?.__resumeStage || input.ctx?.__awaitingApproval || input.ctx?.__awaitingUserQuestion
         );
+        const resumed = Boolean(input.ctx?.__restoredFromSnapshot || pausedMidRun);
+        if (input.ctx?.__restoredFromSnapshot) {
+          const consumedCtx = { ...input.ctx };
+          delete consumedCtx.__restoredFromSnapshot;
+          input = { ...input, ctx: consumedCtx };
+          sessionHolder.value = input;
+        }
         const opened = await openPluginSession(runHost, {
           messages: input.messages || [],
           resumed,
+          pausedMidRun,
           config
         });
         if (opened.denied) {
@@ -11110,7 +11277,7 @@ var HOOKS = {
   sessionStart: { implemented: true },
   userPromptSubmit: {
     implemented: true,
-    notes: "Fires once per run for a new user turn. Skipped on resume, where the transcript tail is a tool result rather than a user message."
+    notes: "Fires once per run whenever the transcript tail is a NEW user turn \u2014 including a turn appended to a state that was restored from a snapshot. Skipped on a genuine resume, where the tail is a tool result rather than a user message."
   },
   preModelCall: {
     implemented: true,
@@ -11123,7 +11290,7 @@ var HOOKS = {
   },
   postToolUse: {
     implemented: true,
-    notes: "Raw output, before compression and the hard cap. Also fires on a tool ERROR. Does NOT fire for a call that parks the run."
+    notes: "Raw output, before compression and the hard cap. Also fires on a tool ERROR, on a preToolUse `result` short-circuit and on a tool-cache hit (`input.source` says which). Does NOT fire for a call that parks the run."
   },
   preCompact: { implemented: true },
   postCompact: { implemented: true },
@@ -12107,6 +12274,12 @@ function auditLog(config = {}) {
       return "[unserializable]";
     }
   };
+  const renderDetail = (detail) => {
+    if (!detail || typeof detail !== "object" || Array.isArray(detail) || !("args" in detail)) return detail;
+    const { args, ...rest } = detail;
+    const rendered = renderArgs(args);
+    return rendered === void 0 ? rest : { ...rest, args: rendered };
+  };
   return {
     name: config.name ?? "audit-log",
     // Lowest number: runs first, so denials by later plugins are still recorded
@@ -12135,7 +12308,7 @@ function auditLog(config = {}) {
           at: (/* @__PURE__ */ new Date()).toISOString(),
           kind: "notification",
           status: kind,
-          detail
+          detail: renderDetail(detail)
         });
       },
       sessionEnd: async ({ status }, ctx) => {