@namzu/sdk 45.1.0 → 48.0.0

package/src/runtime/query/prompt-cache.ts

@@ -1,11 +1,11 @@
 import { createHash } from 'node:crypto'
 import type { PromptContributionRegistry } from '../../prompt/contributions.js'
+import type { ToolManager } from '../../toolsets/manager.js'
 import type { AgentRuntimeContext } from '../../types/agent/base.js'
 import type { AgentContextLevel } from '../../types/agent/factory.js'
 import type { AgentPersona } from '../../types/persona/index.js'
 import type { ProjectId } from '../../types/session/ids.js'
 import type { Skill } from '../../types/skills/index.js'
-import type { ToolRegistryContract } from '../../types/tool/index.js'
 import { PromptBuilder, type PromptSegments } from './prompt.js'
 
 export interface PromptCacheConfig {
@@ -18,7 +18,7 @@ export interface PromptCacheInput {
 	persona?: AgentPersona
 	skills?: Skill[]
 	basePrompt?: string
-	tools: ToolRegistryContract
+	tools: ToolManager
 	allowedTools?: string[]
 	runtimeContext?: AgentRuntimeContext
 	contributions?: PromptContributionRegistry

package/src/runtime/query/prompt.ts

@@ -5,11 +5,11 @@ import {
 	type PromptContributionRegistry,
 	SKILLS_CONTRIBUTION_ID,
 } from '../../prompt/contributions.js'
+import type { ToolManager } from '../../toolsets/manager.js'
 import type { AgentRuntimeContext } from '../../types/agent/base.js'
 import type { AgentContextLevel } from '../../types/agent/factory.js'
 import type { AgentPersona } from '../../types/persona/index.js'
 import type { Skill } from '../../types/skills/index.js'
-import type { ToolRegistryContract } from '../../types/tool/index.js'
 
 export interface PromptSegments {
 	/** Layers 1-6: basePrompt, persona identity/expertise/reflexes/skills/outputDiscipline. Stable within a turn. */
@@ -27,7 +27,7 @@ export interface PromptBuilderConfig {
 
 	basePrompt?: string
 
-	tools: ToolRegistryContract
+	tools: ToolManager
 	allowedTools?: string[]
 	runtimeContext?: AgentRuntimeContext
 	/**
@@ -79,7 +79,7 @@ Resolve relative paths against the working directory above; use supplied absolut
 		const canGlob =
 			tools.has('glob') &&
 			(!allowedTools || allowedTools.includes('glob')) &&
-			tools.getAvailability('glob') === 'active'
+			tools.availability('glob') === 'active'
 		lines.push(
 			canGlob
 				? "For an immediate directory overview, use glob with pattern '*' or an available directory listing tool. Use '**' only when recursive discovery is needed."
@@ -106,7 +106,7 @@ Resolve relative paths against the working directory above; use supplied absolut
  *
  * The name set is kept as a fallback for tools that declare neither.
  */
-function hasFilesystemTools(tools: ToolRegistryContract, allowedTools?: string[]): boolean {
+function hasFilesystemTools(tools: ToolManager, allowedTools?: string[]): boolean {
 	const activeTools = allowedTools ?? tools.listNames()
 	return activeTools.some((name) => {
 		if (FILESYSTEM_TOOLS.has(name)) return true

package/src/runtime/query/resume-session.ts

@@ -1,3 +1,4 @@
+import { assertSessionLogAttribution } from '../../manager/session/attribution.js'
 import type { SessionCheckpointStore } from '../../store/checkpoint/index.js'
 import type { SessionLease, SessionLog } from '../../store/session-log/index.js'
 import { NamzuError } from '../../types/errors/index.js'
@@ -75,6 +76,12 @@ export interface ResumeSessionParams
 export async function resumeSession(params: ResumeSessionParams): Promise<ResumeOutcome> {
 	const { scope, sessionLog, checkpointId, pendingDecision, listener, onEventReplay, ...rest } =
 		params
+	// A caller-chosen checkpoint scope is not proof that the source log belongs
+	// to it. Refuse foreign attribution before reading any checkpoint or park.
+	assertResumeRequestAttribution(params, scope)
+	if (!(await assertSessionLogAttribution(sessionLog, scope))) {
+		return { resumed: false, reason: 'no-checkpoint' }
+	}
 	const checkpointStore =
 		params.checkpointStore ??
 		(
@@ -92,10 +99,34 @@ export async function resumeSession(params: ResumeSessionParams): Promise<Resume
 	if (!state?.checkpointId || !selected) return { resumed: false, reason: 'no-checkpoint' }
 	assertResumeRequestAttribution(params, state)
 
+	// A checkpoint outlives the turn it was written for: nothing prunes it
+	// just because `turn_completed`/`turn_failed` settled that turn, and a
+	// turn that never checkpointed leaves none at all — `no-checkpoint`
+	// above already covers that half. This half is the OTHER way a
+	// checkpoint can stop meaning "resumable": the turn it belongs to
+	// finished. `assertTurnMayStart` (`prepare-turn.ts`) refuses this too,
+	// once `resumeFromCheckpoint` reaches it inside `query()` — but only
+	// after this function has already claimed a lease and resolved storage
+	// under the dead turn's id. Refusing here is cheaper and names the
+	// caller's own mistake instead of `query()`'s internal contract.
+	const active = await sessionLog.activeTurn()
+	if (active?.turnId !== state.turnId) {
+		throw new NamzuError({
+			code: 'invalid_config',
+			message: `Turn ${state.turnId} already ended; a completed or failed turn's checkpoint cannot be resumed.`,
+			details: { sessionId: state.sessionId, turnId: state.turnId },
+		})
+	}
+
 	// A park is outstanding until it is answered.
 	const outstanding = state.pending && !state.pending.resolvedAt ? state.pending : undefined
 	if (outstanding && !pendingDecision) {
-		return { resumed: false, reason: 'awaiting-decision', pending: outstanding, state }
+		return {
+			resumed: false,
+			reason: 'awaiting-decision',
+			pending: outstanding,
+			state,
+		}
 	}
 
 	let replay: SessionLogReplay | undefined
@@ -128,10 +159,18 @@ export async function resumeSession(params: ResumeSessionParams): Promise<Resume
 		listener,
 	)
 
-	return { resumed: true, turn, state, ...(replay !== undefined ? { replay } : {}) }
+	return {
+		resumed: true,
+		turn,
+		state,
+		...(replay !== undefined ? { replay } : {}),
+	}
 }
 
-function assertResumeRequestAttribution(params: ResumeSessionParams, state: TurnState): void {
+function assertResumeRequestAttribution(
+	params: ResumeSessionParams,
+	state: TurnState | TurnStateScope,
+): void {
 	const mismatchedFields: string[] = []
 	if (params.scope.turnId !== state.turnId) mismatchedFields.push('turnId')
 	if (params.sessionId !== state.sessionId) mismatchedFields.push('sessionId')

package/src/runtime/query/review-policy.ts

@@ -21,8 +21,8 @@
  * person (`prompt`).
  */
 
-import type { ToolRegistry } from '../../registry/tool/execute.js'
 import { isTrustedReadOnly } from '../../tools/trusted-read-only.js'
+import type { ToolManager } from '../../toolsets/manager.js'
 import type { HITLResumeDecision, ResumeHandler, ToolCallSummary } from '../../types/hitl/index.js'
 import type { ApprovalPolicy } from '../../types/hitl/policy.js'
 import type { SessionId, TurnId } from '../../types/ids/index.js'
@@ -122,14 +122,16 @@ export const REVIEW_EXEMPT_WRITES: ReadonlySet<string> = new Set([
  * know, or one that declares nothing, is reviewed.
  */
 export function isReviewExempt(
-	registry: Pick<ToolRegistry, 'get'>,
+	registry: Pick<ToolManager, 'get' | 'sourceOf'>,
 	name: string,
 	input: unknown,
 ): boolean {
 	if (REVIEW_EXEMPT_WRITES.has(name.toLowerCase())) return true
-	const tool = registry.get(name) ?? registry.get(name.toLowerCase())
+	const resolvedName = registry.get(name) ? name : name.toLowerCase()
+	const tool = registry.get(resolvedName)
 	if (tool?.category === 'network') return false
-	return isTrustedReadOnly(tool, input)
+	const source = tool ? registry.sourceOf(resolvedName) : undefined
+	return isTrustedReadOnly(tool, input, source)
 }
 
 export type ReviewExemption = (name: string, input: unknown) => boolean
@@ -152,6 +154,7 @@ export function batchNeedsReview(
 			tc.authorization?.explicitReview ||
 			tc.escalation !== undefined ||
 			tc.isDestructive ||
+			tc.requiresApproval === true ||
 			!exempt(tc.name, tc.input),
 	)
 }
@@ -197,6 +200,51 @@ export const SANDBOX_ESCAPE_UNATTENDED_REFUSAL =
 export const OUTSIDE_ROOTS_UNATTENDED_REFUSAL =
 	"Refused: a call in this batch reaches a path outside the working directory and the added directories, which needs a person to approve it each time, and nobody can be asked in this session. Nothing in this batch ran. Stay inside the working directory, or tell the user which directory you need so they can add it to the session (the CLI's --add-dir)."
 
+/**
+ * What the model is told when a batch carries a call the tool itself
+ * declared always needs a person's approval and nobody can be asked.
+ *
+ * Refuses the whole batch, the same way a sandbox escape does: the
+ * declaration is the tool author's, not the operator's, so no rule, mode or
+ * remembered grant can stand in for the person it names.
+ */
+export const REQUIRES_APPROVAL_UNATTENDED_REFUSAL =
+	"Refused: a call in this batch is one the tool itself declared always needs a person's approval, and nobody can be asked in this session. Nothing in this batch ran. This cannot be granted by a rule, an automation mode, a remembered approval or a skill; run it in a session where a person can be asked."
+
+/**
+ * What the model is told when a batch runs a command whose own program name
+ * is decided at runtime and nobody can be asked.
+ *
+ * Refused rather than approved by `auto`: no rule, allow, grant or
+ * unattended setting can vouch for a program nobody can read the name of
+ * before it runs — unlike a sandbox escape, there is no equivalent
+ * "unattended allow" for this.
+ */
+export const UNKNOWN_PROGRAM_UNATTENDED_REFUSAL =
+	'Refused: a call in this batch runs a command whose own program name is decided at runtime (a substitution or a variable stands for it), which needs a person to approve it each time, and nobody can be asked in this session. Nothing in this batch ran. Write the program name literally; compute what needs computing in the arguments instead.'
+
+/**
+ * What the model is told when a batch would show it the operator's screen for
+ * the first time in a session and nobody can be asked.
+ */
+export const SCREEN_CONSENT_UNATTENDED_REFUSAL =
+	"Refused: this call would send what is on the user's screen to the model provider, which a person agrees to once per session, and nobody can be asked in this session. Nothing in this batch ran. Tell the user computer use needs their consent in an interactive session."
+
+/** What the model is told when the operator declines to share the screen. */
+export const SCREEN_CONSENT_DECLINED_FEEDBACK =
+	'The user declined to share their screen in this session. Nothing in this batch ran. Do not take screenshots or read windows again; ask the user how they want to proceed.'
+
+/**
+ * The sessions whose operator agreed to let the model see the screen.
+ *
+ * A host keeps one for as long as its sessions live and hands the same box to
+ * every policy it builds, so a mode switch keeps the answer and a new session
+ * (a different id) is asked again. The policy only adds to it.
+ */
+export interface ScreenConsentRecord {
+	readonly sessions: Set<string>
+}
+
 /** The batch a person is asked about. */
 export interface ToolReviewRequest {
 	/** Originating session, preserved by createReviewHandler for host attribution. */
@@ -204,6 +252,14 @@ export interface ToolReviewRequest {
 	/** Originating turn, preserved by createReviewHandler for host attribution. */
 	readonly turnId?: TurnId
 	readonly toolCalls: readonly ToolCallSummary[]
+	/**
+	 * This batch would send the screen to the model provider for the first
+	 * time in the session (see {@link ReviewPolicyOptions.screenConsent}).
+	 * The question is whether the model may see the screen for the rest of
+	 * the session; a yes also approves this batch, and later screen captures
+	 * in the session run without asking.
+	 */
+	readonly screenConsent?: true
 }
 
 export type ToolReviewAnswer =
@@ -221,7 +277,7 @@ export interface ReviewPolicyOptions {
 	readonly prompt?: ToolReviewPrompt
 	/** Which calls skip review; default `isReviewExempt` over `registry`, or nothing without one. */
 	readonly exempt?: ReviewExemption
-	readonly registry?: Pick<ToolRegistry, 'get'>
+	readonly registry?: Pick<ToolManager, 'get' | 'sourceOf'>
 	/**
 	 * Where "approve all" is remembered. A host that shows the state (a
 	 * badge saying the session is unattended) passes its own box so both
@@ -250,6 +306,24 @@ export interface ReviewPolicyOptions {
 	 * either way.
 	 */
 	readonly skillGrants?: 'honour' | 'ignore'
+	/**
+	 * Ask once per session before the model first sees the screen.
+	 *
+	 * With a record, a batch holding a call that captures the screen
+	 * ({@link capturesScreen}) in a session not yet in `sessions` is put to
+	 * a person first, as a {@link ToolReviewRequest.screenConsent} request,
+	 * even when every call in it only reads: in `prompt`, `accept-edits` and
+	 * `plan`. A yes adds the session; a no refuses the batch. `strict`
+	 * refuses such a call unless a rule allowed it, `auto` never asks, and a
+	 * policy without a `prompt` refuses. A call a rule allowed is never
+	 * asked about. Omitted, the screen is treated like any other read.
+	 */
+	readonly screenConsent?: ScreenConsentRecord
+	/**
+	 * Which calls capture the screen. Default: the tool's own
+	 * `capturesScreen` declaration, read from `registry`; nothing without one.
+	 */
+	readonly capturesScreen?: (name: string, input: unknown) => boolean
 }
 
 /**
@@ -264,7 +338,8 @@ function isSkillGranted(tc: ToolCallSummary): boolean {
 		!tc.authorization?.explicitReview &&
 		tc.authorization?.decision !== 'deny' &&
 		!tc.isDestructive &&
-		tc.escalation === undefined
+		tc.escalation === undefined &&
+		tc.requiresApproval !== true
 	)
 }
 
@@ -276,10 +351,61 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 		options.exempt ??
 		(registry ? (name, input) => isReviewExempt(registry, name, input) : () => false)
 	const remembered = options.remembered ?? { all: false }
+	const capturesScreen =
+		options.capturesScreen ??
+		(registry
+			? (name: string, input: unknown) => {
+					const tool = registry.get(name) ?? registry.get(name.toLowerCase())
+					return tool?.capturesScreen?.(input) === true
+				}
+			: () => false)
 	return async (request): Promise<HITLResumeDecision> => {
 		if (request.type !== 'tool_review') {
 			return request.type === 'plan_approval' ? { action: 'approve_plan' } : { action: 'continue' }
 		}
+		// The one answer a person gives for this batch. The screen question
+		// below shows the whole batch, so its yes also answers any question
+		// the rest of this function would ask; nobody is asked twice.
+		let answered: ToolReviewAnswer | undefined
+		const ask = async (screenConsent?: true): Promise<ToolReviewAnswer> =>
+			answered ??
+			(prompt as ToolReviewPrompt)({
+				sessionId: request.sessionId,
+				turnId: request.turnId,
+				toolCalls: request.toolCalls,
+				...(screenConsent ? { screenConsent } : {}),
+			})
+		// The first look at the screen in a session is the operator's to allow:
+		// what is on it goes to the model provider, and a screenshot reads as
+		// harmlessly as a file read to every rule below. Asked once, in the
+		// modes where a person decides; a rule that allowed the call already
+		// said yes, and a call a rule denied will not run.
+		const consent = options.screenConsent
+		const sessionKey = String(request.sessionId ?? '')
+		if (
+			consent &&
+			mode !== 'auto' &&
+			!consent.sessions.has(sessionKey) &&
+			request.toolCalls.some(
+				(tc) =>
+					tc.authorization?.decision !== 'allow' &&
+					tc.authorization?.decision !== 'deny' &&
+					capturesScreen(tc.name, tc.input),
+			)
+		) {
+			if (mode === 'strict') return { action: 'reject_tools', feedback: STRICT_MODE_REFUSAL }
+			if (!prompt) return { action: 'reject_tools', feedback: SCREEN_CONSENT_UNATTENDED_REFUSAL }
+			const answer = await ask(true)
+			if (answer.kind === 'reject') {
+				return {
+					action: 'reject_tools',
+					feedback: answer.feedback ?? SCREEN_CONSENT_DECLINED_FEEDBACK,
+				}
+			}
+			consent.sessions.add(sessionKey)
+			if (answer.kind === 'approve-all') remembered.all = true
+			answered = answer
+		}
 		if (!batchNeedsReview(request.toolCalls, exempt)) {
 			return { action: 'approve_tools' }
 		}
@@ -295,6 +421,7 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 					!tc.authorization?.explicitReview &&
 					tc.escalation === undefined &&
 					!tc.isDestructive &&
+					tc.requiresApproval !== true &&
 					(ACCEPT_EDITS_TOOLS.has(tc.name) || exempt(tc.name, tc.input)),
 			)
 		) {
@@ -322,15 +449,24 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 			.map((tc) => tc.id)
 		if (escapes.length > 0) {
 			if (!prompt) {
-				return options.unattendedSandboxEscape === 'allow'
-					? { action: 'approve_tools', confirmedEscalations: escapes }
-					: { action: 'reject_tools', feedback: SANDBOX_ESCAPE_UNATTENDED_REFUSAL }
+				if (options.unattendedSandboxEscape !== 'allow') {
+					return { action: 'reject_tools', feedback: SANDBOX_ESCAPE_UNATTENDED_REFUSAL }
+				}
+				// This opt-in confirms only the sandbox escape. A different call in
+				// the batch, or another boundary on this same call, still needs a
+				// person; the early return must not approve that boundary too.
+				if (request.toolCalls.some((tc) => (tc.escalation?.outsidePaths?.length ?? 0) > 0)) {
+					return { action: 'reject_tools', feedback: OUTSIDE_ROOTS_UNATTENDED_REFUSAL }
+				}
+				if (request.toolCalls.some((tc) => tc.requiresApproval === true)) {
+					return { action: 'reject_tools', feedback: REQUIRES_APPROVAL_UNATTENDED_REFUSAL }
+				}
+				if (request.toolCalls.some((tc) => tc.escalation?.unknownProgram !== undefined)) {
+					return { action: 'reject_tools', feedback: UNKNOWN_PROGRAM_UNATTENDED_REFUSAL }
+				}
+				return { action: 'approve_tools', confirmedEscalations: escapes }
 			}
-			const answer = await prompt({
-				sessionId: request.sessionId,
-				turnId: request.turnId,
-				toolCalls: request.toolCalls,
-			})
+			const answer = await ask()
 			if (answer.kind === 'reject') {
 				return {
 					action: 'reject_tools',
@@ -348,11 +484,7 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 		// With nobody to ask it is refused, not approved.
 		if (request.toolCalls.some((tc) => (tc.escalation?.outsidePaths?.length ?? 0) > 0)) {
 			if (!prompt) return { action: 'reject_tools', feedback: OUTSIDE_ROOTS_UNATTENDED_REFUSAL }
-			const answer = await prompt({
-				sessionId: request.sessionId,
-				turnId: request.turnId,
-				toolCalls: request.toolCalls,
-			})
+			const answer = await ask()
 			if (answer.kind === 'reject') {
 				return {
 					action: 'reject_tools',
@@ -363,6 +495,43 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 			if (answer.kind === 'approve-all') remembered.all = true
 			return { action: 'approve_tools' }
 		}
+		// A call the tool itself declared always needs a person's approval is
+		// asked about every time, in every mode that got this far — `auto`
+		// and a remembered "approve all" included, for the same reason an
+		// escape or a path outside the roots is: the tool author's
+		// declaration travels with the tool, and no rule, mode or remembered
+		// grant was ever an answer to IT specifically.
+		if (request.toolCalls.some((tc) => tc.requiresApproval === true)) {
+			if (!prompt) return { action: 'reject_tools', feedback: REQUIRES_APPROVAL_UNATTENDED_REFUSAL }
+			const answer = await ask()
+			if (answer.kind === 'reject') {
+				return {
+					action: 'reject_tools',
+					feedback: answer.feedback ?? DECLINED_TOOL_CALL_FEEDBACK,
+				}
+			}
+			if (answer.kind === 'approve-all') remembered.all = true
+			return { action: 'approve_tools' }
+		}
+		// A command whose own program name is decided at runtime is a
+		// question for a person, every time, for the same reason: no rule, no
+		// remembered grant and no unattended mode can vouch for a program
+		// nobody can read the name of before it runs. There is no
+		// "unattended allow" setting for this the way there is for a sandbox
+		// escape — an operator who wants this can only write the program
+		// name literally.
+		if (request.toolCalls.some((tc) => tc.escalation?.unknownProgram !== undefined)) {
+			if (!prompt) return { action: 'reject_tools', feedback: UNKNOWN_PROGRAM_UNATTENDED_REFUSAL }
+			const answer = await ask()
+			if (answer.kind === 'reject') {
+				return {
+					action: 'reject_tools',
+					feedback: answer.feedback ?? DECLINED_TOOL_CALL_FEEDBACK,
+				}
+			}
+			if (answer.kind === 'approve-all') remembered.all = true
+			return { action: 'approve_tools' }
+		}
 		if (mode === 'auto' || !prompt || remembered.all) {
 			return { action: 'approve_tools' }
 		}
@@ -383,6 +552,7 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 				),
 		)
 		if (
+			answered === undefined &&
 			options.skillGrants !== 'ignore' &&
 			needsPerson.length > 0 &&
 			needsPerson.every(isSkillGranted)
@@ -392,11 +562,7 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 				skillGranted: needsPerson.map((tc) => tc.id),
 			}
 		}
-		const answer = await prompt({
-			sessionId: request.sessionId,
-			turnId: request.turnId,
-			toolCalls: request.toolCalls,
-		})
+		const answer = await ask()
 		switch (answer.kind) {
 			case 'approve':
 				return { action: 'approve_tools' }

package/src/runtime/query/tooling.ts

@@ -2,16 +2,13 @@ import type { AuthorizationGate } from '../../authorization/gate.js'
 import type { SkillGrantSet } from '../../authorization/skill-grant.js'
 import type { PluginLifecycleManager } from '../../plugin/lifecycle.js'
 import type { ActivityStore } from '../../store/activity/memory.js'
+import type { ToolManager } from '../../toolsets/manager.js'
 import type { SessionId, TurnId } from '../../types/ids/index.js'
 import type { InvocationState } from '../../types/invocation/index.js'
 import type { PermissionMode } from '../../types/permission/index.js'
 import type { AuditEventInput } from '../../types/session/audit.js'
 import type { SessionRecord } from '../../types/session/records.js'
-import type {
-	RequestToolPause,
-	SkillRegistryRef,
-	ToolRegistryContract,
-} from '../../types/tool/index.js'
+import type { RequestToolPause, SkillRegistryRef } from '../../types/tool/index.js'
 import type { RepairToolCall } from '../../types/tool/repair.js'
 import type { BackoffPolicy } from '../../utils/backoff.js'
 import type { Logger } from '../../utils/logger.js'
@@ -22,7 +19,7 @@ import type { EmitEvent } from './events.js'
 
 export interface ToolingBootstrapConfig {
 	fileReadTracker?: import('../../types/tool/index.js').FileReadTracker
-	tools: ToolRegistryContract
+	tools: ToolManager
 	sessionId: SessionId
 	turnId: TurnId
 	workingDirectory: string

package/src/runtime/query/turn-state.ts

@@ -1,3 +1,4 @@
+import { assertSessionLogAttribution } from '../../manager/session/attribution.js'
 import type { TurnRecorder } from '../../manager/session/turn-recorder.js'
 import type { SessionCheckpointStore } from '../../store/checkpoint/index.js'
 import type { SessionLog } from '../../store/session-log/index.js'
@@ -113,6 +114,9 @@ export async function loadSelectedTurnContext(
 	readonly checkpoint: Checkpoint
 	readonly messageIds: ReadonlyMap<Message, MessageId>
 } | null> {
+	// A checkpoint scope is supplied by the caller; prove that it owns the
+	// source log before finding a park or reading a checkpoint document.
+	if (!(await assertSessionLogAttribution(log, scope))) return null
 	const storeScope = {
 		tenantId: scope.tenantId,
 		projectId: scope.projectId,