@sema-agent/client-core 0.107.0 → 0.109.0

package/dist/hitl/approvalRequestFrameReading.d.ts

@@ -0,0 +1,14 @@
+export declare const APPROVAL_REQUEST_FRAME_UNREADABLE_WHYS: readonly ["version_unknown", "kind_unknown", "unreadable_fields"];
+export type ApprovalRequestFrameUnreadableWhy = (typeof APPROVAL_REQUEST_FRAME_UNREADABLE_WHYS)[number];
+export type ApprovalRequestFrameReading = {
+    readonly v1: true;
+} | {
+    readonly v1: false;
+    readonly why: ApprovalRequestFrameUnreadableWhy;
+    readonly schemaVersion?: string;
+    readonly kind?: string;
+};
+export declare function approvalRequestFrameReadingThrowing(frame: object | null | undefined): ApprovalRequestFrameReading;
+export declare function approvalRequestFrameReadingOf(frame: object | null | undefined): ApprovalRequestFrameReading;
+export declare function approvalUnreadableWhyWordOf(v: string): ApprovalRequestFrameUnreadableWhy | undefined;
+export declare function approvalFrameUnreadableWhyOf(reading: ApprovalRequestFrameReading | null | undefined): ApprovalRequestFrameUnreadableWhy | undefined;

package/dist/hitl/approvalRequestFrameReading.js

@@ -0,0 +1,79 @@
+import { isApprovalRequestFrameV1 } from '@sema-agent/sdk';
+import { displayUntrusted } from '../displayUntrusted.js';
+export const APPROVAL_REQUEST_FRAME_UNREADABLE_WHYS = Object.freeze(['version_unknown', 'kind_unknown', 'unreadable_fields']);
+const KNOWN_FRAME_TYPE = 'approval_request';
+const KNOWN_SCHEMA_VERSION = 1;
+const KNOWN_KIND = 'permission';
+const FRAME_READING_VALUE_MAX = 24;
+const FRAME_READING_VALUE_PREFIX = 128;
+const V1_READING = Object.freeze({ v1: true });
+const UNREADABLE_READING = Object.freeze({ v1: false, why: 'unreadable_fields' });
+function displayableScalar(v) {
+    let raw;
+    if (typeof v === 'string')
+        raw = v.length > FRAME_READING_VALUE_PREFIX ? v.slice(0, FRAME_READING_VALUE_PREFIX) : v;
+    else if (typeof v === 'number' && Number.isFinite(v))
+        raw = String(v);
+    else
+        return undefined;
+    const shown = displayUntrusted(raw, { max: FRAME_READING_VALUE_MAX });
+    return shown === '' ? undefined : shown;
+}
+export function approvalRequestFrameReadingThrowing(frame) {
+    if (typeof frame !== 'object' || frame === null)
+        return UNREADABLE_READING;
+    const x = frame;
+    const type = x.type;
+    const schemaVersion = x.schemaVersion;
+    const kind = x.kind;
+    const pinned = Object.create(frame, {
+        type: { value: type, enumerable: true },
+        schemaVersion: { value: schemaVersion, enumerable: true },
+        kind: { value: kind, enumerable: true },
+    });
+    if (isApprovalRequestFrameV1(pinned))
+        return V1_READING;
+    const why = type !== KNOWN_FRAME_TYPE
+        ? 'unreadable_fields'
+        : schemaVersion !== KNOWN_SCHEMA_VERSION
+            ? 'version_unknown'
+            : kind !== KNOWN_KIND
+                ? 'kind_unknown'
+                : 'unreadable_fields';
+    const shownVersion = displayableScalar(schemaVersion);
+    const shownKind = displayableScalar(kind);
+    return Object.freeze({
+        v1: false,
+        why,
+        ...(shownVersion !== undefined ? { schemaVersion: shownVersion } : {}),
+        ...(shownKind !== undefined ? { kind: shownKind } : {}),
+    });
+}
+export function approvalRequestFrameReadingOf(frame) {
+    try {
+        return approvalRequestFrameReadingThrowing(frame);
+    }
+    catch {
+        return UNREADABLE_READING;
+    }
+}
+export function approvalUnreadableWhyWordOf(v) {
+    return APPROVAL_REQUEST_FRAME_UNREADABLE_WHYS.find((w) => w === v);
+}
+export function approvalFrameUnreadableWhyOf(reading) {
+    try {
+        if (typeof reading !== 'object' || reading === null)
+            return undefined;
+        const v1 = Object.getOwnPropertyDescriptor(reading, 'v1');
+        const why = Object.getOwnPropertyDescriptor(reading, 'why');
+        if (v1 === undefined || !Object.hasOwn(v1, 'value') || v1.value !== false)
+            return undefined;
+        if (why === undefined || !Object.hasOwn(why, 'value'))
+            return undefined;
+        const word = why.value;
+        return typeof word === 'string' ? approvalUnreadableWhyWordOf(word) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/hitl/approvalResolution.d.ts

@@ -1,6 +1,7 @@
 import type { DecideReceiptView } from '../decideReceipt.js';
 import { type HitlSafetyCode } from './hitlBridge.js';
 import type { AskAnsweredOutput } from './gateLedger.js';
+import type { PolicyDenyCause } from './policyDenyCause.js';
 import type { ApprovalDenySettledBy, ToolApprovalRespondAckView, ToolApprovalRespondDecision, ToolApprovalRespondParkingView } from './toolApprovalWire.js';
 import { type DecisionRefusalReading, type RefusalRouteContext } from './decisionRefusal.js';
 import { type DeliveredReading, type LadderSafetyStop } from './attributionLadder.js';
@@ -14,6 +15,7 @@ export type ApprovalUnsettledCause = (typeof APPROVAL_UNSETTLED_CAUSES)[number];
 export interface ApprovalDenyFacts {
     readonly settledBy?: ApprovalDenySettledBy;
     readonly reason?: string;
+    readonly policyCause?: PolicyDenyCause;
     readonly attributionKey?: 'dropped' | 'renamed';
 }
 interface ApprovalResolutionBase {
@@ -53,6 +55,7 @@ export declare function approvalUnsettledCause(r: ApprovalResolution): ApprovalU
 export declare const APPROVAL_NOTE_RETRACTED_DETAIL = "the card was retracted (this host no longer has a decision port for it)";
 export declare const APPROVAL_NOTE_EDIT_REFUSED_DETAIL = "edits are not accepted on this card";
 export declare function approvalResolutionDetail(r: ApprovalResolution): string | undefined;
+export declare function approvalResolutionStatusTag(r: ApprovalResolution): string;
 export declare function unsettledCauseOfReading(reading: DecisionRefusalReading): 'engine_refused' | 'engine_error' | 'no_answer';
 export interface DecisionFailureMint {
     readonly lane: ApprovalResolutionLane;

package/dist/hitl/approvalResolution.js

@@ -1,11 +1,10 @@
 import { DecideTransportRetryExhaustedError, refusalCarrierOf, safetyStopHeadOf, safetyStopNamed } from './hitlBridge.js';
-import { mintDecisionRefusalReading } from './decisionRefusal.js';
+import { decisionStatusTag, mintDecisionRefusalReading } from './decisionRefusal.js';
 import { isSlotCarrier, thrownIsInstanceOf } from '../wireFailureShape.js';
 import { carrierReadOf, isLocalSafetyStop, localCodeReadOf, topCauseReadOf } from './attributionLadder.js';
 import { directFailureReadingOf, transportReadingOf } from './approvalDelivery.js';
 import { ownReadingSlot } from '../engineWireFor.js';
-import { CHECKPOINT_ROW_BAR_SENTENCE } from '../checkpointRowVerdict.js';
-import { msg, renderMessage } from '../i18n/translate.js';
+import { CHECKPOINT_ROW_BAR_SENTENCE, unboundWayOutContent } from '../checkpointRowVerdict.js';
 export const APPROVAL_RESOLUTION_LANES = Object.freeze(['respond', 'decide', 'ask']);
 export const APPROVAL_NOT_SENT_CAUSES = Object.freeze([
     'retracted',
@@ -95,7 +94,7 @@ export function approvalResolutionDetail(r) {
         const code = cause === 'safety_stop' ? ownStr(r, 'safetyCode') : undefined;
         if (code === undefined)
             return sentence;
-        return code === 'binding_missing' ? `${sentence} (${code}) · ${renderMessage(msg('approval.decide.unboundWayOut'))}` : `${sentence} (${code})`;
+        return code === 'binding_missing' ? `${sentence} (${code}) · ${unboundWayOutContent('unknown')}` : `${sentence} (${code})`;
     }
     if (kind !== 'unsettled')
         return undefined;
@@ -110,6 +109,25 @@ export function approvalResolutionDetail(r) {
     const parts = [ownStr(refusal, 'errorCode'), ownStr(r, 'detail') ?? ownStr(refusal, 'message')].filter((x) => x !== undefined);
     return parts.length > 0 ? parts.join(' · ') : undefined;
 }
+export function approvalResolutionStatusTag(r) {
+    try {
+        if (typeof r !== 'object' || r === null)
+            return '';
+        const kd = Object.getOwnPropertyDescriptor(r, 'kind');
+        if (kd === undefined || !Object.hasOwn(kd, 'value') || kd.value !== 'unsettled')
+            return '';
+        const rd = Object.getOwnPropertyDescriptor(r, 'refusal');
+        const refusal = rd !== undefined && Object.hasOwn(rd, 'value') ? rd.value : undefined;
+        if (typeof refusal !== 'object' || refusal === null)
+            return '';
+        const sd = Object.getOwnPropertyDescriptor(refusal, 'status');
+        const status = sd !== undefined && Object.hasOwn(sd, 'value') ? sd.value : undefined;
+        return typeof status === 'number' && Number.isInteger(status) && status >= 400 && status <= 599 ? decisionStatusTag(status) : '';
+    }
+    catch {
+        return '';
+    }
+}
 export function unsettledCauseOfReading(reading) {
     const standing = ownReadingSlot(reading, 'standing');
     if (standing === 'ambiguous')

package/dist/hitl/approvalsFeed.js

@@ -1,4 +1,5 @@
 import { hostLog } from '../host.js';
+import { invokeHostCallbackIsolated } from '../hostCallbackGuard.js';
 import { unrefTimer } from '../unrefTimer.js';
 import { readLivePendingRows } from './livePendingAsk.js';
 import { createStreamDrainingLegs } from '../streamDrainingLegs.js';
@@ -50,7 +51,7 @@ function readDurablePendingRows(raw) {
 }
 function durableDigestOf(rows) {
     return rows
-        .map(r => [r.sessionId ?? '', r.taskId ?? '', r.toolCallId ?? '', r.boundCallId ?? '', r.boundInputHash ?? '', r.toolName ?? '', JSON.stringify(checkpointRowVerdictOf(r) ?? null), JSON.stringify(parkRowDelegationLinksOf(r) ?? null)]
+        .map(r => [r.sessionId ?? '', r.taskId ?? '', r.toolCallId ?? '', r.boundCallId ?? '', r.boundInputHash ?? '', r.toolName ?? '', r.gateKind ?? '', JSON.stringify(checkpointRowVerdictOf(r) ?? null), JSON.stringify(parkRowDelegationLinksOf(r) ?? null)]
         .join('
'))
         .sort()
         .join('');
@@ -176,12 +177,7 @@ export function startApprovalsFeed(client, onSnapshot, opts) {
         const at = Date.now();
         blind = { why, at };
         stats.unknowns++;
-        try {
-            onSnapshot({ kind: 'unknown', why, at, mode: via });
-        }
-        catch (e) {
-            hostLog('debug', `approvalsFeed: subscriber threw on the unknown arm (swallowed): ${String(e)}`);
-        }
+        invokeHostCallbackIsolated('approvalsFeed: subscriber (unknown arm)', () => onSnapshot({ kind: 'unknown', why, at, mode: via }));
     }
     async function take(via, leg) {
         if (stopped)
@@ -293,12 +289,7 @@ export function startApprovalsFeed(client, onSnapshot, opts) {
         };
         last = snap;
         stats.snapshots++;
-        try {
-            onSnapshot(snap);
-        }
-        catch (e) {
-            hostLog('debug', `approvalsFeed: subscriber threw (swallowed): ${String(e)}`);
-        }
+        invokeHostCallbackIsolated('approvalsFeed: subscriber', () => onSnapshot(snap));
     }
     function schedulePoll() {
         if (stopped || ac.signal.aborted)

package/dist/hitl/askParkRowRouting.js

@@ -1,7 +1,7 @@
 import { askParkForeignGateKind, durableDecideLegOf } from '../adapter/activeRunSelfHeal.js';
 import { isAskTool, questionCardVerdict } from './frameRouter.js';
 import { approvalCallKey } from './gateIdentity.js';
-import { askQuestionsFromPending, pendingRowIsOwnedByThisSession } from './parkOwnership.js';
+import { askQuestionsFromPending, pendingRowIsOwnedByThisSession, pendingRowOwnershipOf } from './parkOwnership.js';
 import { approvalQueueRowFamilyOf, checkpointQueueRowSortOf, QUEUE_ROW_FAMILY_UNREADABLE_GATE } from './approvalQueueRow.js';
 import { checkpointRowBarOf, checkpointRowBarSentence } from '../checkpointRowVerdict.js';
 import { msg, renderMessage } from '../i18n/translate.js';
@@ -37,6 +37,7 @@ export function classifyAskParkRows(queueRows, taskId, deps) {
             kind: 'settled',
             reason: renderMessage(msg('approval.rowUnresumable.askNotSurfaced', { taskId: String(pending.taskId), sentence: checkpointRowBarSentence(bar) })),
             rowVerdict: bar,
+            rowTaskId: askParkRowTaskIdOf(taskId, pending),
         };
     }
     if (foreignKind !== null) {
@@ -50,8 +51,11 @@ export function classifyAskParkRows(queueRows, taskId, deps) {
 function askParkRowGateKind(row) {
     return typeof row.gateKind === 'string' && row.gateKind.length > 0 ? row.gateKind : null;
 }
+function askParkRowTaskIdOf(taskId, row) {
+    return typeof row.taskId === 'string' && row.taskId.length > 0 ? row.taskId : taskId;
+}
 export function askParkRowIdentity(taskId, row) {
-    const rowTaskId = typeof row.taskId === 'string' && row.taskId.length > 0 ? row.taskId : taskId;
+    const rowTaskId = askParkRowTaskIdOf(taskId, row);
     const gatedCallId = row.toolCallId ?? row.boundCallId ?? undefined;
     return { rowTaskId, gatedCallId, armedKey: approvalCallKey(gatedCallId, rowTaskId) };
 }
@@ -157,8 +161,11 @@ export function countOwnedPendingRows(listed, deps) {
             throw new Error('approvals.list answered with a pending row that is not an object — the owned pending count is unknown');
         }
         const family = approvalQueueRowFamilyOf(row);
-        if (family === 'unreadable')
+        if (family === 'unreadable') {
+            if (pendingRowOwnershipOf(row, deps) === 'foreign')
+                continue;
             throw new Error('approvals.list answered with a pending row whose family (`kind`) cannot be read — the owned pending count is unknown');
+        }
         if (family !== 'checkpoint')
             continue;
         if (pendingRowIsOwnedAndDecidable(row, deps))

package/dist/hitl/automaticAnswerVerdict.d.ts

@@ -1,13 +1,15 @@
 import { type CoreModeArbitrationRow } from '../generated/engineFactTables.js';
 import { CORE_ASK_FACES } from '../generated/engineAskFaceTables.js';
 import type { UiLanguage } from '../env/uiLanguage.js';
+import type { PermissionRuleValue } from '@sema-agent/agent-types';
 export type AutomaticAnswerLane = 'mode_posture' | 'standing_rule' | 'permission_request_hook';
 export type AutomaticAnswerAskFace = (typeof CORE_ASK_FACES)[number];
 export interface AutomaticAnswerFacts {
     readonly settingsAskRuleMatched?: boolean;
+    readonly allowRule?: PermissionRuleValue;
 }
 export type AutomaticAnswerRoad = 'origin' | 'requires_real_approval' | 'governance' | 'mandate_word' | 'mandated' | 'allow_rule_shadow' | 'ask_class' | 'settings_ask_rule';
-export type AutomaticAnswerUnknownWhy = 'card_unreadable' | 'lane_not_recognised' | 'classes_malformed' | 'classes_absent' | 'class_not_in_table' | 'host_not_reported';
+export type AutomaticAnswerUnknownWhy = 'card_unreadable' | 'lane_not_recognised' | 'classes_malformed' | 'classes_absent' | 'class_not_in_table' | 'host_not_reported' | 'answer_may_read_arguments';
 export type AutomaticAnswerVerdict = {
     readonly kind: 'must_ask';
     readonly road: AutomaticAnswerRoad;
@@ -22,6 +24,7 @@ export type AutomaticAnswerVerdict = {
 };
 export declare const MODE_ARBITRATION: Readonly<Record<"hook" | "write_protection" | "mode" | "target_unresolved" | "content_question" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "org_rule" | "rule_unreadable" | "ask_rule" | "denial_limit_fallback" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", CoreModeArbitrationRow>>;
 export declare function foldModeArbitrationRow(classes: Iterable<string>, askFace?: AutomaticAnswerAskFace): CoreModeArbitrationRow;
+export declare function askLevelVerdict(card: object | null | undefined, lane: AutomaticAnswerLane, facts?: AutomaticAnswerFacts | null): AutomaticAnswerVerdict;
 export declare function automaticAnswerVerdict(card: object | null | undefined, lane: AutomaticAnswerLane, facts?: AutomaticAnswerFacts | null): AutomaticAnswerVerdict;
 export declare function mandatedApprovalDetailOf(card: object | null | undefined, lang?: UiLanguage): string;
 export interface CrossBoundaryTaintReading {
@@ -29,5 +32,5 @@ export interface CrossBoundaryTaintReading {
 }
 export declare function crossBoundaryTaintOf(carrier: object | null | undefined): CrossBoundaryTaintReading | undefined;
 export declare function crossBoundaryTaintWayOutOf(carrier: object | null | undefined, lang?: UiLanguage): string | undefined;
-export type PermissionRequestHookScope = 'allow_or_deny' | 'deny_only' | 'skip';
+export type PermissionRequestHookScope = 'deny_only' | 'skip';
 export declare function permissionRequestHookScope(verdict: AutomaticAnswerVerdict | null | undefined): PermissionRequestHookScope;

package/dist/hitl/automaticAnswerVerdict.js

@@ -3,6 +3,7 @@ import { CORE_RELEASABLE_ASK_CLASSES_BY_FACE, CORE_SHELL_FACE_TOOL_NAMES } from
 import { mandatedApprovalDetail } from '../gateVocabulary.js';
 import { msg, renderMessage } from '../i18n/translate.js';
 import { guardedRead, readAskOrigin, readOwnDataValue, readOwnNonEmptyString } from '../ownKey.js';
+import { allowRuleScopeOf } from './permissionRuleScope.js';
 import { readAskClassPairState } from './askClassPair.js';
 import { readRequiresRealApproval } from './approvalCardReading.js';
 import { approvalAllowRuleShadowed, retiredAllowRuleShadowKeyPresent } from './allowRuleShadow.js';
@@ -78,6 +79,7 @@ const UNKNOWN = Object.freeze({
     classes_absent: Object.freeze({ kind: 'unknown', why: 'classes_absent' }),
     class_not_in_table: Object.freeze({ kind: 'unknown', why: 'class_not_in_table' }),
     host_not_reported: Object.freeze({ kind: 'unknown', why: 'host_not_reported' }),
+    answer_may_read_arguments: Object.freeze({ kind: 'unknown', why: 'answer_may_read_arguments' }),
 });
 const MAY_ANSWER = Object.freeze({ kind: 'may_answer' });
 function evidenceView(card, ...keys) {
@@ -142,7 +144,7 @@ function readHostAskRuleMatched(facts) {
     const v = guardedRead(() => readOwnDataValue(facts, 'settingsAskRuleMatched'));
     return typeof v === 'boolean' ? v : undefined;
 }
-export function automaticAnswerVerdict(card, lane, facts) {
+export function askLevelVerdict(card, lane, facts) {
     if (lane !== 'mode_posture' && lane !== 'standing_rule' && lane !== 'permission_request_hook')
         return UNKNOWN.lane_not_recognised;
     try {
@@ -214,6 +216,18 @@ export function automaticAnswerVerdict(card, lane, facts) {
         return UNKNOWN.card_unreadable;
     }
 }
+function reportedWholeToolAllowRule(facts) {
+    if (typeof facts !== 'object' || facts === null)
+        return false;
+    const raw = guardedRead(() => readOwnDataValue(facts, 'allowRule'));
+    return allowRuleScopeOf(typeof raw === 'object' ? raw : undefined) === 'whole_tool';
+}
+export function automaticAnswerVerdict(card, lane, facts) {
+    const asked = askLevelVerdict(card, lane, facts);
+    if (asked.kind !== 'may_answer' || lane === 'mode_posture')
+        return asked;
+    return lane === 'standing_rule' && reportedWholeToolAllowRule(facts) ? asked : UNKNOWN.answer_may_read_arguments;
+}
 export function mandatedApprovalDetailOf(card, lang) {
     try {
         if (typeof card !== 'object' || card === null)
@@ -276,7 +290,7 @@ export function crossBoundaryTaintWayOutOf(carrier, lang) {
 export function permissionRequestHookScope(verdict) {
     try {
         const kind = typeof verdict === 'object' && verdict !== null ? verdict.kind : undefined;
-        return kind === 'may_answer' ? 'allow_or_deny' : kind === 'must_ask' ? 'skip' : 'deny_only';
+        return kind === 'must_ask' ? 'skip' : 'deny_only';
     }
     catch {
         return 'deny_only';

package/dist/hitl/decisionConflict.d.ts

@@ -3,5 +3,6 @@ import type { CapturedCode } from '../engineWireFor.js';
 import { type ProtocolErrorNameReading } from '../wireFailureShape.js';
 export type DecisionRefusalConflict = 'binding_mismatch' | 'row_integrity' | 'format_version' | 'answer_invalid' | 'grant_changed';
 export declare function decisionConflictOf(err: unknown, captured?: CapturedCode, protocolNameRead?: ProtocolErrorNameReading): DecisionRefusalConflict | undefined;
-export declare const DECISION_ANSWER_INVALID_CONTENT = "The engine rejected the answer itself because it does not fit the question that was asked \u00B7 Nothing was decided and the question is still waiting \u00B7 Correct the answer and send it again";
+export declare function decisionAnswerInvalidContent(lang?: UiLanguage): string;
+export declare const DECISION_ANSWER_INVALID_CONTENT: string;
 export declare function decisionGrantChangedContent(lang?: UiLanguage): string;

package/dist/hitl/decisionConflict.js

@@ -45,7 +45,10 @@ export function decisionConflictOf(err, captured, protocolNameRead) {
     }
     return BINDING_SEAT_FIELDS.has(field) ? 'binding_mismatch' : undefined;
 }
-export const DECISION_ANSWER_INVALID_CONTENT = 'The engine rejected the answer itself because it does not fit the question that was asked · Nothing was decided and the question is still waiting · Correct the answer and send it again';
+export function decisionAnswerInvalidContent(lang) {
+    return renderMessage(msg('approval.decision.answerInvalid'), lang);
+}
+export const DECISION_ANSWER_INVALID_CONTENT = decisionAnswerInvalidContent();
 export function decisionGrantChangedContent(lang) {
     return renderMessage(msg('approval.decision.grantChanged'), lang);
 }

package/dist/hitl/decisionRefusal.d.ts

@@ -78,5 +78,6 @@ export interface UndeliverableDecisionFacts {
     readonly end: UndeliverableDecisionEnd;
     readonly runId?: string;
 }
+export declare function decisionStatusTag(status: number, errorCode?: string): string;
 export declare function undeliverableDecisionContent(facts: UndeliverableDecisionFacts): string;
 export declare function decideRowUnrevivableNotice(lang?: UiLanguage | (string & {})): string;

package/dist/hitl/decisionRefusal.js

@@ -314,9 +314,12 @@ export function decisionRefusalClosesOut(refusal, pending) {
         return false;
     return standing === 'ambiguous' || standing === 'refused-pending';
 }
+export function decisionStatusTag(status, errorCode) {
+    const code = typeof errorCode === 'string' && isDisplayableWireCode(errorCode) ? ` ${errorCode}` : '';
+    return `(HTTP ${String(status)}${code})`;
+}
 export function undeliverableDecisionContent(facts) {
-    const code = typeof facts.errorCode === 'string' && isDisplayableWireCode(facts.errorCode) ? ` ${facts.errorCode}` : '';
-    const head = `The engine refused the approval decision this client sent (HTTP ${String(facts.status)}${code}), so the call it asked about could not be answered from here and did not run`;
+    const head = `The engine refused the approval decision this client sent ${decisionStatusTag(facts.status, facts.errorCode)}, so the call it asked about could not be answered from here and did not run`;
     const runId = typeof facts.runId === 'string' && isDisplayableWireCode(facts.runId) ? ` ${facts.runId}` : '';
     switch (facts.end) {
         case 'run-stopped':

package/dist/hitl/decisionSend.js

@@ -1,5 +1,6 @@
 import { settleWithinDeadline } from '../abortableSleep.js';
 import { hostLog } from '../host.js';
+import { invokeHostCallbackIsolated } from '../hostCallbackGuard.js';
 import { msg, renderMessage } from '../i18n/translate.js';
 import { askGoneFromError } from '../decideReceipt.js';
 import { appendOwnElement, guardedRead, readOwnDataNonEmptyString, readOwnDataValue } from '../ownKey.js';
@@ -343,12 +344,7 @@ function holdFits(handle, req) {
     }
 }
 function callHold(call) {
-    try {
-        call();
-    }
-    catch (e) {
-        hostLog('debug', `decisionSend.callHold: ${String(e).slice(0, 120)}`);
-    }
+    invokeHostCallbackIsolated('decisionSend: hold verb', call);
 }
 function hostField(holder, key) {
     if (typeof holder !== 'object' || holder === null)

package/dist/hitl/frameRouter.d.ts

@@ -1,8 +1,8 @@
 import type { AgentEvent } from '@sema-agent/sdk';
 import type { DecideOperationObserver, HitlClientLike } from './hitlBridge.js';
 import { type RespondToolApprovalFn, type ToolApprovalFrame, type ToolApprovalFrameLaneOpts } from './toolApprovalWire.js';
-import type { ApprovalResolution } from './approvalResolution.js';
-import type { GateLedger } from './gateLedger.js';
+import type { ApprovalDenyFacts, ApprovalResolution } from './approvalResolution.js';
+import type { GateLedger, GateDenyAttribution } from './gateLedger.js';
 import type { NoAllowCause } from './noAllowCause.js';
 import { type ReplayedApprovalDisposition } from './replayedApproval.js';
 import type { ReattachDrainingEvent } from '../runReattachPolicy.js';
@@ -17,6 +17,7 @@ export interface PolicyDenyReasonFacts {
     readonly budgetSetting?: string;
 }
 export declare function policyDenyReason(facts: PolicyDenyReasonFacts): string;
+export declare function denyAttributionOf(deny: ApprovalDenyFacts | undefined): GateDenyAttribution;
 export declare const HITL_INTERRUPT_MESSAGE_FOR_TOOL_USE = "[Request interrupted by user for tool use]";
 export declare const ENGINE_ABORT_TOOL_RESULT = "Operation aborted";
 export interface ParkReattachNotice {

package/dist/hitl/frameRouter.js

@@ -13,6 +13,8 @@ import { surfaceForCurrentSession, surfaceReplayedApprovalListUnreadable } from
 import { liveCardHoldOf, noteEngineClosedApproval, settleEngineClosedApproval } from './approvalHolds.js';
 import { approvalCompleteParked } from './approvalCompleteParked.js';
 import { liveFrameCallKey } from './gateIdentity.js';
+import { readPolicyDenyCause } from './policyDenyCause.js';
+import { msg, renderMessage } from '../i18n/translate.js';
 import { SEMA_DENIAL_KIND_KEY, hasLedgerPositionKey } from './gateLedger.js';
 import { replayedApprovalClosesCardFrame, replayedApprovalDisposition, settledApprovalDisposition } from './replayedApproval.js';
 import { settleWithinDeadline } from '../abortableSleep.js';
@@ -30,7 +32,11 @@ export function policyDenyReason(facts) {
     const one = typeof facts.toolName === 'string' && SENTENCE_TOOL_NAME.test(facts.toolName) ? `this one "${facts.toolName}" call` : 'this one call';
     const flag = typeof facts.allowRuleFlag === 'string' && SENTENCE_TOOL_NAME.test(facts.allowRuleFlag.replace(/^--?/, '')) ? ` (or ${facts.allowRuleFlag})` : '';
     const budgetKnob = typeof facts.budgetSetting === 'string' && SENTENCE_TOOL_NAME.test(facts.budgetSetting) ? facts.budgetSetting : undefined;
-    const cause = facts.cause === 'no_allow_rule' || facts.cause === 'ask_rule' || facts.cause === 'engine_ask_rule' || facts.cause === 'budget' ? facts.cause : 'other';
+    const cause = facts.cause === 'no_allow_rule' || facts.cause === 'ask_rule' || facts.cause === 'engine_ask_rule' || facts.cause === 'budget' || facts.cause === 'whole_tool_rule_only'
+        ? facts.cause
+        : 'other';
+    const wholeToolOnly = 'this client does not approve calls from the arguments shown to it, so here only an allow rule for the whole tool can approve calls like this ahead of time — ' +
+        'a rule that names paths, commands or other arguments applies only where the engine checks it against the real arguments';
     if (facts.lane === 'dont_ask') {
         const mode = 'denied by the dontAsk permission mode';
         switch (cause) {
@@ -42,6 +48,8 @@ export function policyDenyReason(facts) {
                 return `${mode}: a rule on the engine side, not one of the user's permission rules, asks about ${one}, and this mode refuses anything that would ask — the user's settings cannot approve it; use another permission mode to answer it`;
             case 'budget':
                 return `${mode}: ${one} needed approval, and this session's automatic-approval budget is used up, so saved rules no longer approve calls${budgetKnob !== undefined ? ` — raise ${budgetKnob} before launch to change the cap` : ''}`;
+            case 'whole_tool_rule_only':
+                return `${mode}: ${one} needed approval; ${wholeToolOnly} — and this mode refuses anything that would ask; use another permission mode to answer it`;
             default:
                 return `${mode}: ${one} needed a person's approval that saved permission rules cannot approve here (the engine or your deployment requires a person for it, or it could not be checked against your rules), and this mode refuses anything that would ask — use another permission mode to answer it`;
         }
@@ -57,6 +65,8 @@ export function policyDenyReason(facts) {
             return `${lane}: a rule on the engine side, not one of the user's permission rules, asks about ${one}, so it needed a person's answer, and ${tail}; the user's settings cannot approve it - run the task interactively to answer it`;
         case 'budget':
             return `${lane}: ${one} needed a person's approval, and this session's automatic-approval budget is used up, so saved rules no longer approve calls; ${tail}${budgetKnob !== undefined ? `; raise ${budgetKnob} before launch to change the cap` : ''}`;
+        case 'whole_tool_rule_only':
+            return `${lane}: ${one} needed a person's approval; ${wholeToolOnly}; ${tail}; run the task interactively to answer it`;
         default:
             return `${lane}: ${one} needed a person's approval, and saved permission rules cannot approve it here (the engine or your deployment requires a person for it, or it could not be checked against your rules); ${tail}; run the task interactively to answer it`;
     }
@@ -64,10 +74,33 @@ export function policyDenyReason(facts) {
 function denyOutputForRender(attribution) {
     if (attribution?.settledBy !== 'policy')
         return HITL_REJECT_MESSAGE;
+    const head = policyDenyHeadFor(readPolicyDenyCause(attribution));
     const reason = attribution.reason;
     return reason !== undefined && reason.trim() !== ''
-        ? `${HITL_POLICY_DENY_MESSAGE}\n${reason}`
-        : HITL_POLICY_DENY_MESSAGE;
+        ? `${head}\n${reason}`
+        : head;
+}
+function policyDenyHeadFor(cause) {
+    const tail = msg('approval.policyDeny.tail');
+    switch (cause) {
+        case 'dont_ask':
+            return renderMessage(msg('approval.policyDeny.dontAsk', { tail }));
+        case 'deny_rule':
+            return renderMessage(msg('approval.policyDeny.denyRule', { tail }));
+        case 'engine_floor':
+            return renderMessage(msg('approval.policyDeny.engineFloor', { tail }));
+        case 'no_approval_ui':
+        case undefined:
+            return HITL_POLICY_DENY_MESSAGE;
+    }
+}
+export function denyAttributionOf(deny) {
+    const policyCause = readPolicyDenyCause(deny);
+    return {
+        ...(deny?.settledBy !== undefined ? { settledBy: deny.settledBy } : {}),
+        ...(deny?.reason !== undefined ? { reason: deny.reason } : {}),
+        ...(policyCause !== undefined ? { policyCause } : {}),
+    };
 }
 function denialKindForTranscript(attribution) {
     return ccToolDenialKindForSettledBy(attribution?.settledBy);
@@ -354,10 +387,7 @@ function settleLiveCardOutcome(ev, outcome, ctx, fromSubagent, gatedCallId) {
         invokeHostCallbackIsolated('liveHitlAskWire: onToolApprovalOutcome', () => deps.onToolApprovalOutcome?.(ev, outcome));
     }
     if (outcome.kind === 'decided' && outcome.decision === 'deny' && !fromSubagent) {
-        const attribution = {
-            ...(outcome.deny?.settledBy !== undefined ? { settledBy: outcome.deny.settledBy } : {}),
-            ...(outcome.deny?.reason !== undefined ? { reason: outcome.deny.reason } : {}),
-        };
+        const attribution = denyAttributionOf(outcome.deny);
         if (gatedCallId !== undefined)
             led.markDenied(gatedCallId, attribution);
         else

package/dist/hitl/gateLedger.d.ts

@@ -1,9 +1,11 @@
 import type { AgentEvent } from '@sema-agent/sdk';
+import { type PolicyDenyCause } from './policyDenyCause.js';
 export declare const SEMA_COLLATERAL_ABORT_KEY = "_sema_collateral_abort";
 export declare const SEMA_DENIAL_KIND_KEY = "_sema_denial_kind";
 export interface GateDenyAttribution {
     settledBy?: 'human' | 'policy';
     reason?: string;
+    policyCause?: PolicyDenyCause;
 }
 export interface AskAnsweredOutput {
     type: 'ask-user-question';

package/dist/hitl/gateLedger.js

@@ -1,5 +1,6 @@
 import { parkedToolEndRoleOf } from '../engineRowRef.js';
 import { inheritFrameBinding } from '../frameBinding.js';
+import { readPolicyDenyCause } from './policyDenyCause.js';
 export const SEMA_COLLATERAL_ABORT_KEY = '_sema_collateral_abort';
 export const SEMA_DENIAL_KIND_KEY = '_sema_denial_kind';
 export function durableSeqOf(ev) {
@@ -27,9 +28,10 @@ function normalizeDenyAttribution(a) {
         return undefined;
     const settledBy = a.settledBy === 'human' || a.settledBy === 'policy' ? a.settledBy : undefined;
     const reason = typeof a.reason === 'string' && a.reason.trim() !== '' ? a.reason : undefined;
+    const policyCause = settledBy === 'policy' ? readPolicyDenyCause(a) : undefined;
     if (settledBy === undefined && reason === undefined)
         return undefined;
-    return { ...(settledBy !== undefined ? { settledBy } : {}), ...(reason !== undefined ? { reason } : {}) };
+    return { ...(settledBy !== undefined ? { settledBy } : {}), ...(reason !== undefined ? { reason } : {}), ...(policyCause !== undefined ? { policyCause } : {}) };
 }
 export function createGateLedger() {
     const startedCalls = new Set();

package/dist/hitl/hitlBridge.d.ts

@@ -141,6 +141,10 @@ export type FindPendingOutcome = {
 export declare function findPendingForTask(client: HitlClientLike, taskId: string, matches: (toolName: string | undefined) => boolean, opts?: {
     signal?: AbortSignal;
 }, callId?: string, identityAccepts?: (row: PendingCheckpoint) => boolean): Promise<FindPendingOutcome>;
+export declare function checkpointQueueReadingOf(row: object): {
+    readonly r: PendingCheckpoint;
+    readonly foreign: string | null;
+} | undefined;
 export declare class HitlBridge {
     private readonly client;
     private readonly taskId;

package/dist/hitl/hitlBridge.js

@@ -11,8 +11,7 @@ import { suspendedReopenOf } from './suspendedReopen.js';
 import { closeDecisionOp, decisionLedgerKeysOf, openDecisionOp } from './decisionLedger.js';
 import { askParkBlockGeneration, noteAskParkDecideSettled } from './askParkAutoReopenBlock.js';
 import { checkpointQueueRowSortOf, QUEUE_ROW_FAMILY_UNREADABLE_GATE } from './approvalQueueRow.js';
-import { checkpointRowBarOf, checkpointRowBarSentence } from '../checkpointRowVerdict.js';
-import { msg, renderMessage } from '../i18n/translate.js';
+import { checkpointDeadlineStateOf, checkpointRowBarOf, checkpointRowBarSentence, unboundWayOutContent } from '../checkpointRowVerdict.js';
 export const DEFAULT_DENY_REASON = 'The user rejected this tool use';
 export const MAX_DENY_REASON_CHARS = 4096;
 export function denyReasonForWire(reason, tag) {
@@ -271,11 +270,8 @@ export async function findPendingForTask(client, taskId, matches, opts, callId,
         return { ok: false, reason: `approvals.list failed: ${t.reason}` };
     }
     const readings = rows.flatMap((r) => {
-        const sort = checkpointQueueRowSortOf(r);
-        if (sort === 'excluded')
-            return [];
-        const cp = r;
-        return [{ r: cp, foreign: sort === 'unreadable' ? QUEUE_ROW_FAMILY_UNREADABLE_GATE : askParkForeignGateKind(cp) }];
+        const x = checkpointQueueReadingOf(r);
+        return x === undefined ? [] : [x];
     });
     const decidable = readings.filter((x) => x.foreign === null).map((x) => x.r);
     const identityRow = callId !== undefined
@@ -314,6 +310,13 @@ export async function findPendingForTask(client, taskId, matches, opts, callId,
         return { ok: false, reason: checkpointRowBarSentence(bar), code: 'row_unresumable', rowVerdict: bar };
     return { ok: true, pending, gatedCallId: pending.toolCallId ?? pending.boundCallId ?? undefined };
 }
+export function checkpointQueueReadingOf(row) {
+    const sort = checkpointQueueRowSortOf(row);
+    if (sort === 'excluded')
+        return undefined;
+    const cp = row;
+    return { r: cp, foreign: sort === 'unreadable' ? QUEUE_ROW_FAMILY_UNREADABLE_GATE : askParkForeignGateKind(cp) };
+}
 export class HitlBridge {
     client;
     taskId;
@@ -365,7 +368,7 @@ export class HitlBridge {
         if (typeof boundCallId !== 'string' || boundCallId.length === 0 || typeof boundInputHash !== 'string' || boundInputHash.length === 0) {
             throw new HitlSafetyError(`pending checkpoint ${p.id ?? '<no-id>'} is missing D-1 binding fields ` +
                 `(boundCallId=${String(boundCallId)}, boundInputHash=${String(boundInputHash)}) — ` +
-                `the row itself carries no binding to echo, so ${renderMessage(msg('approval.decide.unboundWayOut'))}`, 'binding_missing');
+                `the row itself carries no binding to echo, so ${unboundWayOutContent(checkpointDeadlineStateOf(p))}`, 'binding_missing');
         }
         return { boundCallId, boundInputHash };
     }