@sema-agent/client-core 0.100.0 → 0.101.0

package/dist/hitl/hitlBridge.d.ts

@@ -1,5 +1,6 @@
-import type { AgentEvent, ApprovalDecidedBy, ApprovalDecision, ApprovalStaleError, PendingCheckpoint, CheckpointGate, PlanReviewRequest, AssistantTaskStatus } from '@sema-agent/sdk';
+import type { AgentEvent, ApprovalDecidedBy, ApprovalDecision, ApprovalStaleError, PendingCheckpoint, CheckpointGate, PlanReviewRequest, AssistantTaskStatus, QuestionAnswerItem } from '@sema-agent/sdk';
 import type { PermissionResult } from '@sema-agent/agent-types';
+import { type CapturedLocalCode, type CauseSlotRead } from '../engineWireFor.js';
 import type { ApprovalsListEnvelope } from './crashConverged.js';
 import { type SuspendedReopenReading } from './suspendedReopen.js';
 export declare const DEFAULT_DENY_REASON = "The user rejected this tool use";
@@ -33,11 +34,7 @@ export interface HitlClientLike {
     approvals: ApprovalsResourceLike;
     assistant: AssistantResourceLike;
 }
-export interface AskAnswer {
-    header: string;
-    selected: string[];
-    note?: string;
-}
+export type AskAnswer = QuestionAnswerItem;
 export interface PlanReviewOutcome {
     decision: 'approve' | 'edit' | 'reject';
     editedPlan?: string;
@@ -63,6 +60,21 @@ export declare class HitlSafetyError extends Error {
     readonly code: HitlSafetyCode;
     constructor(message: string, code: HitlSafetyCode, options?: ErrorOptions);
 }
+export interface RefusalCarrier {
+    readonly local?: HitlSafetyCode;
+    readonly carrier: {} | null | undefined;
+}
+export declare function refusalCarrierOf(err: {} | null | undefined, localCodeRead?: {
+    readonly value: CapturedLocalCode;
+}, answeredLayer?: boolean, causeRead?: CauseSlotRead, headRead?: SafetyStopHead): RefusalCarrier;
+export declare function safetyStopNamed(err: {} | null | undefined): boolean;
+export interface SafetyStopHead {
+    readonly named: boolean;
+    readonly local?: HitlSafetyCode;
+}
+export declare function safetyStopHeadOf(err: {} | null | undefined, localCodeRead?: {
+    readonly value: CapturedLocalCode;
+}, namedRead?: boolean): SafetyStopHead;
 export declare function hitlSafetyCodeOf(e: unknown): HitlSafetyCode | undefined;
 export type GateCurrentPending = Readonly<NonNullable<ApprovalStaleError['currentPending']>>;
 export declare function readDecideCurrentPending(e: unknown): GateCurrentPending | undefined;

package/dist/hitl/hitlBridge.js

@@ -3,11 +3,13 @@ import { eventSeq } from '../adapter/types.js';
 import { hostLog } from '../host.js';
 import { invokeHostCallbackIsolated } from '../hostCallbackGuard.js';
 import { abortableSleep } from '../abortableSleep.js';
-import { ownDataField, readOwnDataValue } from '../ownKey.js';
-import { PROTOCOL_ERROR_NAME, THROWN_SLOT_UNREADABLE, protocolErrorNameReading, readBlockedBy, readThrownSlot, thrownIsInstanceOf, wireFailureTextsOf } from '../wireFailureShape.js';
+import { attemptTimeoutOnChain, causeSlotReadOf, transportChainReading } from '../engineWireFor.js';
+import { guardedRead, ownDataField, readOwnDataValue } from '../ownKey.js';
+import { PROTOCOL_ERROR_NAME, isSlotCarrier, protocolErrorNameReading, readBlockedBy, readThrownSlot, thrownIsInstanceOf, wireFailureTextsOf } from '../wireFailureShape.js';
 import { APPROVAL_BINDING_MISMATCH, CHECKPOINT_INVALID_OUTCOME, RESUME_POLICY_FOLD_CODE } from '../engineErrorCodes.js';
 import { suspendedReopenOf } from './suspendedReopen.js';
 import { closeDecisionOp, decisionLedgerKeysOf, openDecisionOp } from './decisionLedger.js';
+import { askParkBlockGeneration, noteAskParkDecideSettled } from './askParkAutoReopenBlock.js';
 export const DEFAULT_DENY_REASON = 'The user rejected this tool use';
 export const MAX_DENY_REASON_CHARS = 4096;
 export function denyReasonForWire(reason, tag) {
@@ -53,6 +55,30 @@ export class HitlSafetyError extends Error {
         this.name = 'HitlSafetyError';
     }
 }
+export function refusalCarrierOf(err, localCodeRead, answeredLayer = false, causeRead, headRead) {
+    if (!isSlotCarrier(err))
+        return { carrier: err };
+    const head = headRead ?? safetyStopHeadOf(err, localCodeRead);
+    if (!head.named)
+        return { carrier: err };
+    const read = answeredLayer ? undefined : (causeRead ?? causeSlotReadOf(err));
+    const cause = read !== undefined && read.presence === 'present' ? read.value : undefined;
+    const carrier = isSlotCarrier(cause) ? cause : err;
+    return head.local !== undefined ? { local: head.local, carrier } : { carrier };
+}
+export function safetyStopNamed(err) {
+    return isSlotCarrier(err) && guardedRead(() => ownDataField(err, 'name')) === 'HitlSafetyError';
+}
+export function safetyStopHeadOf(err, localCodeRead, namedRead) {
+    if (!isSlotCarrier(err))
+        return { named: false };
+    if (!(namedRead ?? safetyStopNamed(err)))
+        return { named: false };
+    const own = (k) => guardedRead(() => ownDataField(err, k));
+    const code = localCodeRead !== undefined ? localCodeRead.value : own('code');
+    const local = typeof code === 'string' && GATE_FAILURE_CODES.includes(code) ? code : undefined;
+    return local !== undefined ? { named: true, local } : { named: true };
+}
 export function hitlSafetyCodeOf(e) {
     if (!thrownIsInstanceOf(e, HitlSafetyError))
         return undefined;
@@ -70,12 +96,12 @@ void _gateCurrentPendingReadonlyPin;
 export function readDecideCurrentPending(e) {
     if (e === null || e === undefined)
         return undefined;
-    const raw = readThrownSlot(e, 'currentPending');
+    const raw = readThrownSlot(e, 'currentPending', 'data');
     if (typeof raw !== 'object' || raw === null)
         return undefined;
-    const toolName = readThrownSlot(raw, 'toolName');
-    const boundCallId = readThrownSlot(raw, 'boundCallId');
-    const boundInputHash = readThrownSlot(raw, 'boundInputHash');
+    const toolName = readThrownSlot(raw, 'toolName', 'data');
+    const boundCallId = readThrownSlot(raw, 'boundCallId', 'data');
+    const boundInputHash = readThrownSlot(raw, 'boundInputHash', 'data');
     if (typeof toolName !== 'string' || toolName.length === 0)
         return undefined;
     if (typeof boundCallId !== 'string' || boundCallId.length === 0)
@@ -130,36 +156,8 @@ export function __setDecideTimeoutRetryBudgetForTests(ms) {
 function decideTimeoutRetryBudgetMs() {
     return decideTimeoutRetryBudgetOverrideMs ?? DECIDE_TIMEOUT_RETRY_TOTAL_BUDGET_MS;
 }
-function isDecideAttemptTimeout(e, depth = 0) {
-    if (depth > 3 || e === null || typeof e !== 'object')
-        return false;
-    if (readThrownSlot(e, 'name') === 'TimeoutError')
-        return true;
-    return isDecideAttemptTimeout(readThrownSlot(e, 'cause'), depth + 1);
-}
-const TRANSIENT_NETWORK_CODES = new Set([
-    'ECONNREFUSED', 'ECONNRESET', 'ETIMEDOUT', 'EPIPE', 'EAI_AGAIN',
-    'ENETUNREACH', 'EHOSTUNREACH', 'ECONNABORTED',
-    'UND_ERR_CONNECT_TIMEOUT', 'UND_ERR_HEADERS_TIMEOUT', 'UND_ERR_BODY_TIMEOUT', 'UND_ERR_SOCKET',
-]);
-function isTransientDecideTransportFailure(e, depth = 0) {
-    if (depth > 3 || e === null || typeof e !== 'object')
-        return false;
-    if (thrownIsInstanceOf(e, HitlSafetyError))
-        return false;
-    const status = readThrownSlot(e, 'status', 'data');
-    if (status === THROWN_SLOT_UNREADABLE || typeof status === 'number')
-        return false;
-    const name = readThrownSlot(e, 'name');
-    if (name === 'TimeoutError' || name === 'AbortError')
-        return true;
-    const code = readThrownSlot(e, 'code', 'data');
-    if (typeof code === 'string' && TRANSIENT_NETWORK_CODES.has(code))
-        return true;
-    const message = readThrownSlot(e, 'message');
-    if (typeof message === 'string' && message.toLowerCase().includes('fetch failed'))
-        return true;
-    return isTransientDecideTransportFailure(readThrownSlot(e, 'cause'), depth + 1);
+function isTransientDecideTransportFailure(e) {
+    return transportChainReading(e, 'retry', (layer) => thrownIsInstanceOf(layer, HitlSafetyError)) === 'transient';
 }
 export class DecideTransportRetryExhaustedError extends Error {
     attempts;
@@ -199,15 +197,18 @@ class DecideSpan {
         }
         this.inFlight++;
         const tally = { attempts: 0 };
+        const blockGen = askParkBlockGeneration(identity.sessionId);
         try {
             const r = await send(tally);
             this.ok = true;
             this.retryExhausted = false;
+            noteAskParkDecideSettled(identity, blockGen, { ok: true });
             return r;
         }
         catch (e) {
             this.ok = false;
             this.retryExhausted = thrownIsInstanceOf(e, DecideTransportRetryExhaustedError);
+            noteAskParkDecideSettled(identity, blockGen, { ok: false, error: e });
             throw e;
         }
         finally {
@@ -419,6 +420,7 @@ export class HitlBridge {
         const tally = { attempts: 0 };
         const identity = this.decideIdentityOf(sessionId, decision);
         const ledgerOp = openDecideLedgerOp(identity);
+        const blockGen = askParkBlockGeneration(identity.sessionId);
         if (observer !== undefined)
             notifyDecideObserver(observer, Object.freeze({ ...identity, phase: 'start' }));
         let ok = false;
@@ -426,10 +428,12 @@ export class HitlBridge {
         try {
             const r = await this.decideRawAttempts(sessionId, decision, opts, tally);
             ok = true;
+            noteAskParkDecideSettled(identity, blockGen, { ok: true });
             return r;
         }
         catch (e) {
             retryExhausted = thrownIsInstanceOf(e, DecideTransportRetryExhaustedError);
+            noteAskParkDecideSettled(identity, blockGen, { ok: false, error: e });
             throw e;
         }
         finally {
@@ -473,7 +477,7 @@ export class HitlBridge {
                     throw e;
                 if (!isTransientDecideTransportFailure(e) || callerAborted())
                     throw e;
-                if (isDecideAttemptTimeout(e)) {
+                if (attemptTimeoutOnChain(e)) {
                     if (attempts >= DECIDE_TIMEOUT_MIN_ATTEMPTS && Date.now() - startedAt >= decideTimeoutRetryBudgetMs()) {
                         throw new DecideTransportRetryExhaustedError(attempts, wireFailureTextsOf(e).reason);
                     }

package/dist/hitl/livePendingAsk.js

@@ -1,3 +1,4 @@
+import { appendOwnElement } from '../ownKey.js';
 import { readRequiresRealApproval } from './approvalCardReading.js';
 import { THROWN_SLOT_UNREADABLE, readThrownSlot } from '../wireFailureShape.js';
 import { isToolApprovalFrame, surfaceToolApprovalFrameAndRespond, } from './toolApprovalWire.js';
@@ -14,9 +15,9 @@ function snapshotMembers(raw) {
     const out = [];
     for (let i = 0; i < length; i++) {
         const d = Object.getOwnPropertyDescriptor(raw, i);
-        if (d === undefined || !('value' in d))
+        if (d === undefined || !Object.hasOwn(d, 'value'))
             return undefined;
-        out.push(d.value);
+        appendOwnElement(out, d.value);
     }
     return raw.length === length ? out : undefined;
 }
@@ -26,7 +27,7 @@ export function readLivePendingRows(body) {
     const field = Object.getOwnPropertyDescriptor(body, 'livePending');
     if (field === undefined)
         return 'livePending' in body ? { kind: 'malformed' } : { kind: 'not_reported' };
-    if (!('value' in field))
+    if (!Object.hasOwn(field, 'value'))
         return { kind: 'malformed' };
     const raw = field.value;
     if (raw === undefined)

package/dist/hitl/noAllowCause.js

@@ -4,7 +4,7 @@ function ladderSays(ladder, key) {
         return false;
     try {
         const d = Object.getOwnPropertyDescriptor(ladder, key);
-        return d !== undefined && 'value' in d && d.value === true;
+        return d !== undefined && Object.hasOwn(d, 'value') && d.value === true;
     }
     catch {
         return false;

package/dist/hitl/parkResolver.js

@@ -1,6 +1,6 @@
 import { putOwnKey, readOwnDataValue } from '../ownKey.js';
 import { HitlBridge, NO_QUESTION_OVERLAY_REASON, findPendingForTask, isNoDecisionSurfaceReason, } from './hitlBridge.js';
-import { approvalResolutionDetail, resolutionOfDecisionFailure } from './approvalResolution.js';
+import { approvalResolutionDetail, directSafetyStopOf, resolutionOfDecisionFailure } from './approvalResolution.js';
 import { readDecisionRefusalAsk } from './decisionRefusal.js';
 import { publishQuestionFrame, registerLocalQuestionResponder, hasQuestionOverlay, } from '../liveQuestionStore.js';
 import { hostLog } from '../host.js';
@@ -136,9 +136,10 @@ async function surfaceGateAndDecide(deps, taskId, askArgsByCall, signal, parkGat
         return { kind: 'decided', ...at, decision: 'deny', ...(declinedReceipt !== undefined ? { receipt: declinedReceipt } : {}) };
     }
     catch (e) {
+        const directStop = directSafetyStopOf(e);
         const failureTexts = wireFailureTextsOf(e);
         hostLog('debug', `liveHitlAskWire: decide failed: ${failureTexts.log}`);
-        return resolutionOfDecisionFailure(e, { lane: 'ask', route: 'ask_decide', gatedCallId, detail: `decide failed: ${failureTexts.reason}${decideFailureNote(e, attemptedDecision)}` });
+        return resolutionOfDecisionFailure(e, { lane: 'ask', route: 'ask_decide', gatedCallId, detail: `decide failed: ${failureTexts.reason}${decideFailureNote(e, attemptedDecision)}`, ...(directStop !== undefined ? { directStop } : {}) });
     }
 }
 function argsByCallOf(led) {

package/dist/hitl/persistedRulesWire.js

@@ -207,6 +207,7 @@ const PERSISTED_RULE_MATCH_KEYS = Object.freeze({
     name_prefix: 'rules.match.namePrefix',
     host: 'rules.match.host',
     subdomain: 'rules.match.subdomain',
+    pattern: 'rules.match.pattern',
 });
 export function persistedRuleMatchLabel(ruleOrMatch, lang) {
     const word = typeof ruleOrMatch === 'string' ? ruleOrMatch : ownSlot(ruleOrMatch, 'match');

package/dist/hitl/planReviewWire.d.ts

@@ -43,6 +43,9 @@ export interface PlanReviewQuestionIdReading {
 }
 export declare function planReviewTaskIdFromQuestionId(questionId: {} | null | undefined): PlanReviewQuestionIdReading | undefined;
 export declare function planReviewOfferedModeOf(card: string | PlanReviewCardLike): PlanReviewOfferedMode;
+export declare function planReviewShownLabelsOf(questionId: {} | null | undefined): readonly string[] | undefined;
+export declare function planReviewAnswerChoiceOf(questionId: {} | null | undefined, answer: QuestionAnswer | null | undefined): PlanReviewChoice | 'dismissed';
+export declare function planReviewAnswerDecisionOf(questionId: {} | null | undefined, answer: QuestionAnswer | null | undefined): 'approve' | 'reject' | 'dismissed';
 export interface ArmPlanReviewOptions {
     submittedInPlanMode?: boolean;
     readGateInstanceKeys?: PlanReviewGateInstanceReader;
@@ -56,6 +59,7 @@ export interface PlanReviewOutcomeMeta {
     dispatchNo: number;
     decision: 'approve' | 'reject';
     effect: PlanReviewDecisionEffect;
+    cause?: 'stored_form_unsupported';
 }
 export declare function planReviewOutcomeTail(taskId: string, decision: 'approve' | 'reject', effect: PlanReviewDecisionEffect, cause?: 'stored_form_unsupported'): string;
 export type PlanReviewWireClient = {

package/dist/hitl/planReviewWire.js

@@ -7,10 +7,11 @@ import { enqueuePlanReviewOutcome } from '../notifications.js';
 import { corruptStoredRowContent, corruptStoredRowWhere } from '../wireErrorTriage.js';
 import { decideFailureNote } from '../decideFailureNote.js';
 import { wireFailureTextsOf } from '../wireFailureShape.js';
-import { readOwnDataNonEmptyString, readOwnDataValue } from '../ownKey.js';
+import { appendOwnElement, readOwnDataNonEmptyString, readOwnDataValue } from '../ownKey.js';
 import { checkpointUnsupportedVersionContent, checkpointUnsupportedVersionFromError, resumeContextUnavailableContent, resumeContextUnavailableFromError } from '../resumeRefusalCopy.js';
 import { REQUEST_FIELD_CONFLICT } from '../engineErrorCodes.js';
 import { refusalDeliveryOf } from './decisionRefusal.js';
+import { directFailureVerdictOf, directSafetyStopOf } from './approvalResolution.js';
 import { __resetDecisionLedgerForTests, decisionInFlightOf, decisionKeyInFlight, decisionLedgerKeysOf, decisionOpsWithKey, decisionReadMark, dropDecisionOp, latestDecisionHandedMark, markLatestDecisionNotApplied, openDecisionOp, planDecisionKey, readMarkOf, settleDecisionOp, settleDecisionOpsOnGateLeft, } from './decisionLedger.js';
 import { denyReasonForWire, isPlanReviewModeAfter } from './hitlBridge.js';
 import { planReviewQuestionId, REOPEN_ID_TAIL, taskIdFromPlanReviewQuestionId } from './gateIdentity.js';
@@ -26,12 +27,8 @@ export const PLAN_REVIEW_APPROVE_MANUAL_LABEL = 'Yes, and manually approve edits
 const APPROVE_LABEL = PLAN_REVIEW_APPROVE_LABEL;
 const REJECT_LABEL = PLAN_REVIEW_REJECT_LABEL;
 const LEGACY_TWO_CHOICE_LABELS = Object.freeze([PLAN_REVIEW_APPROVE_LABEL, PLAN_REVIEW_REJECT_LABEL]);
-const ALL_KNOWN_LABELS = Object.freeze([
-    PLAN_REVIEW_APPROVE_AUTO_LABEL,
-    PLAN_REVIEW_APPROVE_MANUAL_LABEL,
-    PLAN_REVIEW_APPROVE_LABEL,
-    PLAN_REVIEW_REJECT_LABEL,
-]);
+const THREE_CHOICE_LABELS = Object.freeze([PLAN_REVIEW_APPROVE_AUTO_LABEL, PLAN_REVIEW_APPROVE_MANUAL_LABEL, PLAN_REVIEW_REJECT_LABEL]);
+const ANY_CARD_SHAPE_LABELS = Object.freeze([PLAN_REVIEW_APPROVE_AUTO_LABEL, PLAN_REVIEW_APPROVE_MANUAL_LABEL, PLAN_REVIEW_APPROVE_LABEL, PLAN_REVIEW_REJECT_LABEL]);
 export function planReviewDecisionFromAnswer(answer, shownLabels = LEGACY_TWO_CHOICE_LABELS) {
     const { choice } = readPlanReviewAnswer(answer, shownLabels);
     if (choice === 'dismissed')
@@ -101,7 +98,7 @@ export function notePlanReviewAnsweredIfDecisive(questionId, answer) {
     notePlanReviewAnsweredIfDecisiveFor(DEFAULT_SESSION_KEY, questionId, answer);
 }
 function notePlanReviewAnsweredIfDecisiveFor(sessionKey, questionId, answer) {
-    if (planReviewDecisionFromAnswer(answer ?? { answers: [] }, ALL_KNOWN_LABELS) === 'dismissed')
+    if (planReviewDecisionFromAnswer(answer ?? { answers: [] }, planReviewShownLabelsOf(questionId) ?? ANY_CARD_SHAPE_LABELS) === 'dismissed')
         return;
     notePlanReviewAnsweredFor(sessionKey, questionId);
     const taskId = typeof questionId === 'string' ? taskIdFromPlanReviewQuestionId(questionId) : undefined;
@@ -276,7 +273,7 @@ function ownElementsOf(v, max) {
     const n = Math.min(v.length, max);
     const out = [];
     for (let i = 0; i < n; i++)
-        out.push(readOwnDataValue(v, String(i)));
+        appendOwnElement(out, readOwnDataValue(v, String(i)));
     return out;
 }
 function offeredModeFromLabels(card) {
@@ -333,6 +330,33 @@ export function planReviewOfferedModeOf(card) {
         return 'unknown';
     }
 }
+export function planReviewShownLabelsOf(questionId) {
+    try {
+        if (typeof questionId !== 'string')
+            return undefined;
+        const recorded = offeredModeByQuestionId.get(questionId);
+        if (recorded !== undefined)
+            return recorded ? THREE_CHOICE_LABELS : LEGACY_TWO_CHOICE_LABELS;
+        for (const t of armedPlanReviewTaskIds) {
+            if (planReviewQuestionId(t) === questionId)
+                return offerModeAfterByTask.get(t) === true ? THREE_CHOICE_LABELS : LEGACY_TWO_CHOICE_LABELS;
+        }
+        if (taskIdFromPlanReviewQuestionId(questionId) === undefined)
+            return undefined;
+        return questionId.includes(REOPEN_ID_TAIL) ? LEGACY_TWO_CHOICE_LABELS : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function planReviewAnswerChoiceOf(questionId, answer) {
+    const shown = planReviewShownLabelsOf(questionId);
+    return shown === undefined ? 'dismissed' : planReviewChoiceFromAnswer(answer, shown);
+}
+export function planReviewAnswerDecisionOf(questionId, answer) {
+    const shown = planReviewShownLabelsOf(questionId);
+    return shown === undefined ? 'dismissed' : planReviewDecisionFromAnswer(answer, shown);
+}
 export function armPlanReviewApproval(result, sessionKey, opts) {
     let armedTaskId;
     try {
@@ -378,10 +402,9 @@ export function armPlanReviewApproval(result, sessionKey, opts) {
             offerModeAfterByTask.delete(taskId);
         const questionId = planReviewQuestionId(taskId);
         const unregister = registerLocalQuestionResponder(questionId, async (_id, answer) => {
+            const choice = planReviewAnswerChoiceOf(questionId, answer);
             unregister();
             armedPlanReviewTaskIds.delete(taskId);
-            const shown = planReviewCardOptions(offerModeAfterByTask.get(taskId) === true).map(o => o.label);
-            const choice = planReviewChoiceFromAnswer(answer, shown);
             if (choice === 'dismissed') {
                 notePlanReviewUserDismissalFor(DEFAULT_SESSION_KEY, taskId, opts?.readGateInstanceKeys, questionId);
                 return { ok: true };
@@ -539,22 +562,22 @@ function planReviewSettledVerdict(r) {
     const status = r.postStatus ?? r.bodyStatus;
     const gateMoved = r.gateBefore !== undefined && r.gateAfter !== undefined && r.gateAfter !== r.gateBefore;
     if (r.reparked)
-        return status !== 'completed' && !gateMoved ? { effect: 'still_parked', proven: true } : { effect: 'unconfirmed', proven: false };
+        return status !== 'completed' && !gateMoved ? 'still_parked' : 'unconfirmed';
     if (status === 'completed')
-        return { effect: 'took_effect', proven: false };
+        return 'took_effect';
     const newGateHasCard = () => {
         const leg = durableDecideLegOf({ gateKind: r.gateKindAfter ?? null });
         return leg === 'approval' || leg === 'plan_review';
     };
     if (status === 'suspended' && r.postStatus === 'suspended' && newGateHasCard())
-        return { effect: 'advanced', proven: false };
+        return 'advanced';
     if (status === 'needs_review' && r.postStatus === 'needs_review' && r.gateBefore !== undefined && r.gateAfter !== undefined) {
         if (r.gateAfter === r.gateBefore)
-            return { effect: 'still_parked', proven: true };
+            return 'still_parked';
         if (newGateHasCard())
-            return { effect: 'advanced', proven: false };
+            return 'advanced';
     }
-    return { effect: 'unconfirmed', proven: false };
+    return 'unconfirmed';
 }
 function bodyWordOf(body, key) {
     try {
@@ -629,7 +652,6 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
     let outcome;
     let effect = 'unconfirmed';
     let stillParkedCause;
-    let stillParkedProven = false;
     let statusSeen;
     const wire = opts?.wire;
     const resolved = engineWireFor(clientOnlyView(wire), DEFAULT_SESSION_KEY, usablePlanReviewWireClient);
@@ -672,7 +694,8 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
                 }
                 catch (e1) {
                     const conflict = e1;
-                    if (mode === 'default' && conflict?.status === 400 && conflict?.errorCode === REQUEST_FIELD_CONFLICT) {
+                    const defaultConflict = mode === 'default' && conflict?.status === 400 && conflict?.errorCode === REQUEST_FIELD_CONFLICT;
+                    if (defaultConflict && !directFailureVerdictOf(e1, directSafetyStopOf(e1)).yields) {
                         hostLog('debug', 'planReviewWire: permissionModeAfter "default" refused as not applicable — re-sending the approval without the key (same meaning)');
                         body = await sendOnce(undefined, () => client.assistant.planReview(taskId, reason !== undefined ? { decision, reason } : { decision }));
                     }
@@ -713,9 +736,7 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
                 const bodyStatus = bodyWordOf(body, 'status');
                 const effective = postStatus ?? bodyStatus;
                 statusSeen = effective;
-                const verdict = planReviewSettledVerdict({ postStatus, bodyStatus, reparked: bodySaysReparked(body), gateBefore, gateAfter, gateKindAfter });
-                effect = verdict.effect;
-                stillParkedProven = verdict.proven;
+                effect = planReviewSettledVerdict({ postStatus, bodyStatus, reparked: bodySaysReparked(body), gateBefore, gateAfter, gateKindAfter });
                 const code = bodyWordOf(body, 'errorCode');
                 if (effect === 'still_parked' && postStatus === 'needs_review' && !bodySaysReparked(body)) {
                     outcome =
@@ -761,14 +782,13 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
                 const noAnswer = typeof status === 'number' || typeof e !== 'object' ? null : noAnswerKindOf(e);
                 if (status === 400 && refusedCode === REQUEST_FIELD_CONFLICT && permissionModeAfter === 'acceptEdits') {
                     hostLog('debug', `planReviewWire: ${decision} + acceptEdits refused (request.field_conflict) — NOT re-sent with a different mode`);
-                    effect = 'still_parked';
-                    stillParkedProven = true;
+                    effect = decision === 'approve' ? 'still_parked' : 'not_applied';
                     outcome =
                         decision === 'approve'
                             ? 'The plan approval was NOT applied: the engine refused "auto-accept edits" for this task (it was not started read-only in plan mode, so that option does not apply). ' +
                                 'Nothing changed engine-side — the plan is still waiting for review. Tell the user plainly, and that approving with "manually approve edits" will go through.'
                             : `The plan ${decision} was NOT applied: the engine refused the post-approval permission mode that was sent with it (request.field_conflict). ` +
-                                'Nothing changed engine-side — the plan is still waiting for review. Tell the user plainly that the decision did not go through.';
+                                'This request changed nothing engine-side. Tell the user plainly that the decision did not go through.';
                 }
                 else if (status === 404 && refusedCode === 'not_found.plan_review') {
                     hostLog('debug', `planReviewWire: ${decision} → 404 not_found.plan_review (no pending plan review any more — an earlier decision likely settled it)`);
@@ -781,7 +801,6 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
                     const cu = checkpointUnsupportedVersionFromError(e);
                     hostLog('debug', `planReviewWire: ${decision} → 409 checkpoint.unsupported_version (the server cannot continue this parked review in its stored form; still pending)`);
                     effect = 'still_parked';
-                    stillParkedProven = true;
                     stillParkedCause = 'stored_form_unsupported';
                     outcome = `This ${decision} was not applied. ${checkpointUnsupportedVersionContent(cu, { parkKind: 'plan_review', runId: taskId })}`;
                 }
@@ -822,9 +841,9 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
     const tail = planReviewOutcomeTail(taskId, decision, effect, stillParkedCause);
     const prompt = `<plan-review-outcome>\n${outcome}\n${tail}\n</plan-review-outcome>`;
     const onOutcome = opts?.onOutcome;
-    settle(effect === 'not_sent' || (effect === 'still_parked' && stillParkedProven));
+    settle(effect === 'not_sent' || effect === 'still_parked');
     try {
-        const delivered = enqueuePlanReviewOutcome(prompt, { taskId, dispatchNo, decision, effect });
+        const delivered = enqueuePlanReviewOutcome(prompt, { taskId, dispatchNo, decision, effect, ...(effect === 'still_parked' && stillParkedCause !== undefined ? { cause: stillParkedCause } : {}) });
         if (!delivered) {
             if (onOutcome !== undefined) {
                 hostLog('debug', `planReviewWire: outcome queue port not installed for task ${taskId} — outcome handed to the host's onOutcome callback only`);
@@ -839,7 +858,17 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
     }
     if (onOutcome !== undefined) {
         try {
-            onOutcome({ taskId, dispatchNo, decision, effect, detail: outcome, tail, prompt, ...(statusSeen !== undefined ? { status: statusSeen } : {}) });
+            onOutcome({
+                taskId,
+                dispatchNo,
+                decision,
+                effect,
+                ...(effect === 'still_parked' && stillParkedCause !== undefined ? { cause: stillParkedCause } : {}),
+                detail: outcome,
+                tail,
+                prompt,
+                ...(statusSeen !== undefined ? { status: statusSeen } : {}),
+            });
         }
         catch (e) {
             hostLog('debug', `planReviewWire: onOutcome callback threw for task ${taskId} (ignored): ${String(e)}`);
@@ -956,7 +985,7 @@ function mintPlanReviewReopenCard(taskId, opts, sessionKey, receiptMs) {
         if (activeReopenResponders.get(activeKey)?.questionId === questionId) {
             activeReopenResponders.delete(activeKey);
         }
-        const choice = planReviewChoiceFromAnswer(answer, LEGACY_TWO_CHOICE_LABELS);
+        const choice = planReviewAnswerChoiceOf(questionId, answer);
         if (choice === 'dismissed') {
             notePlanReviewUserDismissalFor(sessionKey, taskId, opts?.readGateInstanceKeys, questionId);
             return { ok: true };

package/dist/hitl/resumeRunningCard.d.ts

@@ -26,6 +26,7 @@ export declare function resumeRunningNoUiGuidance(i: {
     taskId: string;
     sessionId?: string | null;
 }): string;
-export declare function resumeAttachReplayDisclosure(taskId: string): string;
+export declare function resumeAttachReplayDisclosure(taskId: string, lane?: CardSentenceLane): string;
+export type CardSentenceLane = 'interactive' | 'print' | 'utility';
 export declare function resumeRunningCancelConfirmedRow(taskId: string): string;
-export declare function resumeRunningCancelUnconfirmedRow(taskId: string): string;
+export declare function resumeRunningCancelUnconfirmedRow(taskId: string, lane?: CardSentenceLane): string;

package/dist/hitl/resumeRunningCard.js

@@ -62,22 +62,28 @@ export function resumeRunningNoUiGuidance(i) {
         `${T} background=do nothing — run ${i.taskId} keeps executing on the engine; this client does not list it (read it with GET /v1/runs/${i.taskId})`,
     ].join('\n');
 }
-export function resumeAttachReplayDisclosure(taskId) {
+export function resumeAttachReplayDisclosure(taskId, lane) {
     return (`sema: attaching to run ${taskId} — sema is replaying it from the engine's ledger, so anything from that ` +
         `turn already shown above will appear again below. There is no resume marker for a run that outlived its shell. ` +
-        `The replayed turns are not billed into this session's cost again either — the engine's own record ` +
-        `(GET /v1/runs/${taskId}) is the authority on what that run really spent.`);
+        `The replayed turns are not billed into this session's cost again either — ` +
+        (interactiveCardLane(lane)
+            ? `the engine's own record of run ${taskId} is the authority on what that run really spent.`
+            : `the engine's own record (GET /v1/runs/${taskId}) is the authority on what that run really spent.`));
 }
-function cancelRow(taskId, confirmed) {
-    return confirmed
-        ? `The engine accepted the cancel for run ${taskId} on your request. A cancel finishes on the engine's side, so that run may need a moment to stop.`
-        : `sema: the cancel for run ${taskId} did not come back confirmed, so that run may still be executing. ` +
-            `This screen does not list it — read its real state on the engine (GET /v1/runs/${taskId}) before ` +
-            `assuming this session is free.`;
+function cancelRow(taskId, confirmed, lane) {
+    if (confirmed)
+        return `The engine accepted the cancel for run ${taskId} on your request. A cancel finishes on the engine's side, so that run may need a moment to stop.`;
+    return (`sema: the cancel for run ${taskId} did not come back confirmed, so that run may still be executing. ` +
+        (interactiveCardLane(lane)
+            ? `This screen does not list it — its real state lives on the engine, under run ${taskId}, so do not assume this session is free.`
+            : `This screen does not list it — read its real state on the engine (GET /v1/runs/${taskId}) before assuming this session is free.`));
+}
+function interactiveCardLane(lane) {
+    return lane !== 'print' && lane !== 'utility';
 }
 export function resumeRunningCancelConfirmedRow(taskId) {
     return cancelRow(taskId, true);
 }
-export function resumeRunningCancelUnconfirmedRow(taskId) {
-    return cancelRow(taskId, false);
+export function resumeRunningCancelUnconfirmedRow(taskId, lane) {
+    return cancelRow(taskId, false, lane);
 }

package/dist/hitl/sessionPolicyDeliverable.d.ts

@@ -1,7 +1,9 @@
 import type { SessionPermissionRules } from '@sema-agent/sdk';
 import type { ToolRosterView } from '../toolRoster.js';
+import type { SessionRulesNamespaceFormsReading } from '../sessionRulesNamespaceFormsCapability.js';
+import type { UiLanguage } from '../env/uiLanguage.js';
 import type { SessionRuleInertReason } from './sessionPolicyWire.js';
-export type SessionPolicyWithheldWhy = 'ask_no_bucket' | 'qualified_deny' | 'peer_wide' | 'wildcard' | 'not_a_tool_name' | 'legacy_tool_name' | 'not_in_roster';
+export type SessionPolicyWithheldWhy = 'ask_no_bucket' | 'qualified_deny' | 'peer_wide' | 'wildcard' | 'not_a_tool_name' | 'legacy_tool_name' | 'not_in_roster' | 'namespace_covering_unconfirmed';
 export declare const SESSION_POLICY_WITHHELD_WHY: readonly SessionPolicyWithheldWhy[];
 export interface SessionPolicyWithheldRule {
     readonly rule: string;
@@ -16,7 +18,8 @@ export interface SessionPolicyDeliverability {
 }
 export interface SessionPolicyDeliverableOptions {
     readonly roster?: ToolRosterView;
+    readonly namespaceForms?: SessionRulesNamespaceFormsReading;
 }
 export declare function sessionPolicyDeliverable(behavior: 'deny' | 'ask', rules: readonly string[], opts?: SessionPolicyDeliverableOptions): SessionPolicyDeliverability;
-export declare function sessionPolicyWithheldNotice(why: SessionPolicyWithheldWhy): string;
+export declare function sessionPolicyWithheldNotice(why: SessionPolicyWithheldWhy, lang?: UiLanguage): string;
 export declare function legacyToolNameFailureNoteOf(code: string | undefined): string | undefined;