@sema-agent/client-core 0.108.0 → 0.110.0

package/dist/hitl/frameRouter.js

@@ -10,13 +10,13 @@ import { guardedRead, readOwnDataValue } from '../ownKey.js';
 import { parkHeldCallIdOf } from '../engineRowRef.js';
 import { inheritFrameBinding } from '../frameBinding.js';
 import { surfaceForCurrentSession, surfaceReplayedApprovalListUnreadable } from './hitlHostSurface.js';
-import { liveCardHoldOf, noteEngineClosedApproval, settleEngineClosedApproval } from './approvalHolds.js';
+import { liveCardHoldOf, settleEngineClosedApproval } from './approvalHolds.js';
 import { approvalCompleteParked } from './approvalCompleteParked.js';
 import { liveFrameCallKey } from './gateIdentity.js';
 import { readPolicyDenyCause } from './policyDenyCause.js';
 import { msg, renderMessage } from '../i18n/translate.js';
 import { SEMA_DENIAL_KIND_KEY, hasLedgerPositionKey } from './gateLedger.js';
-import { replayedApprovalClosesCardFrame, replayedApprovalDisposition, settledApprovalDisposition } from './replayedApproval.js';
+import { replayedApprovalDisposition, settledApprovalDisposition } from './replayedApproval.js';
 import { settleWithinDeadline } from '../abortableSleep.js';
 import { ccToolDenialKindForSettledBy } from '../gateVocabulary.js';
 import { REJECT_MESSAGE } from '../adapt/wireShapes.js';
@@ -32,7 +32,11 @@ export function policyDenyReason(facts) {
     const one = typeof facts.toolName === 'string' && SENTENCE_TOOL_NAME.test(facts.toolName) ? `this one "${facts.toolName}" call` : 'this one call';
     const flag = typeof facts.allowRuleFlag === 'string' && SENTENCE_TOOL_NAME.test(facts.allowRuleFlag.replace(/^--?/, '')) ? ` (or ${facts.allowRuleFlag})` : '';
     const budgetKnob = typeof facts.budgetSetting === 'string' && SENTENCE_TOOL_NAME.test(facts.budgetSetting) ? facts.budgetSetting : undefined;
-    const cause = facts.cause === 'no_allow_rule' || facts.cause === 'ask_rule' || facts.cause === 'engine_ask_rule' || facts.cause === 'budget' ? facts.cause : 'other';
+    const cause = facts.cause === 'no_allow_rule' || facts.cause === 'ask_rule' || facts.cause === 'engine_ask_rule' || facts.cause === 'budget' || facts.cause === 'whole_tool_rule_only'
+        ? facts.cause
+        : 'other';
+    const wholeToolOnly = 'this client does not approve calls from the arguments shown to it, so here only an allow rule for the whole tool can approve calls like this ahead of time — ' +
+        'a rule that names paths, commands or other arguments applies only where the engine checks it against the real arguments';
     if (facts.lane === 'dont_ask') {
         const mode = 'denied by the dontAsk permission mode';
         switch (cause) {
@@ -44,6 +48,8 @@ export function policyDenyReason(facts) {
                 return `${mode}: a rule on the engine side, not one of the user's permission rules, asks about ${one}, and this mode refuses anything that would ask — the user's settings cannot approve it; use another permission mode to answer it`;
             case 'budget':
                 return `${mode}: ${one} needed approval, and this session's automatic-approval budget is used up, so saved rules no longer approve calls${budgetKnob !== undefined ? ` — raise ${budgetKnob} before launch to change the cap` : ''}`;
+            case 'whole_tool_rule_only':
+                return `${mode}: ${one} needed approval; ${wholeToolOnly} — and this mode refuses anything that would ask; use another permission mode to answer it`;
             default:
                 return `${mode}: ${one} needed a person's approval that saved permission rules cannot approve here (the engine or your deployment requires a person for it, or it could not be checked against your rules), and this mode refuses anything that would ask — use another permission mode to answer it`;
         }
@@ -59,6 +65,8 @@ export function policyDenyReason(facts) {
             return `${lane}: a rule on the engine side, not one of the user's permission rules, asks about ${one}, so it needed a person's answer, and ${tail}; the user's settings cannot approve it - run the task interactively to answer it`;
         case 'budget':
             return `${lane}: ${one} needed a person's approval, and this session's automatic-approval budget is used up, so saved rules no longer approve calls; ${tail}${budgetKnob !== undefined ? `; raise ${budgetKnob} before launch to change the cap` : ''}`;
+        case 'whole_tool_rule_only':
+            return `${lane}: ${one} needed a person's approval; ${wholeToolOnly}; ${tail}; run the task interactively to answer it`;
         default:
             return `${lane}: ${one} needed a person's approval, and saved permission rules cannot approve it here (the engine or your deployment requires a person for it, or it could not be checked against your rules); ${tail}; run the task interactively to answer it`;
     }
@@ -341,7 +349,7 @@ async function routeToolApprovalFrame(ev, ctx) {
         return { kind: 'skip' };
     }
     const settledHere = settledApprovalDisposition(ev);
-    if (settledHere !== undefined || (hasLedgerPositionKey(ev) && !led.preambleApprovals().has(ev.approvalId))) {
+    if (settledHere !== undefined || hasLedgerPositionKey(ev)) {
         const disposition = settledHere ?? (await judgeLedgerApprovalFrame(ev, ctx));
         if (disposition.kind !== 'live') {
             hostLog('debug', disposition.kind === 'decided' && disposition.settled !== undefined
@@ -349,8 +357,6 @@ async function routeToolApprovalFrame(ev, ctx) {
                 : `liveHitlAskWire: tool_approval frame ${ev.approvalId} read back from the run event log is ${disposition.kind}` +
                     `${disposition.kind === 'unknown' ? ` (${disposition.why})` : disposition.cause !== undefined ? ` (${disposition.cause})` : ''}` +
                     ' — not raised as a question, no decision sent');
-            if (settledHere === undefined && replayedApprovalClosesCardFrame(disposition))
-                noteEngineClosedApproval(ev.approvalId, false);
             if (disposition.kind === 'unknown' && ctx.signal?.aborted !== true)
                 surfaceReplayedApprovalListUnreadable();
             if (deps.onReplayedApproval !== undefined) {
@@ -408,7 +414,7 @@ async function judgeLedgerApprovalFrame(ev, ctx) {
             .finally(release);
     });
     const approvals = got.kind === 'value' ? { read: 'ok', body: got.value } : { read: 'failed' };
-    return replayedApprovalDisposition(ev, { preamble: ctx.led.preambleApprovals(), approvals });
+    return replayedApprovalDisposition(ev, { approvals });
 }
 function routeToolStart(ev, callId, led) {
     led.noteStart(callId, ev);
@@ -503,17 +509,5 @@ export async function routeFrame(ev, ctx) {
     if (ev.type === 'failed') {
         return { kind: 'end', events: [...flushHeldWithInterruptRewrite(led, { terminal: ev, signal: ctx.signal }), ev] };
     }
-    if (ev.type === 'approval_request') {
-        try {
-            if (!hasLedgerPositionKey(ev)) {
-                const id = ev.approvalId;
-                if (typeof id === 'string' && id !== '')
-                    led.notePreambleApproval(id);
-            }
-        }
-        catch (e) {
-            hostLog('debug', `liveHitlAskWire: approval_request frame unreadable — not counted as preamble evidence: ${String(e).slice(0, 120)}`);
-        }
-    }
     return { kind: 'yield', events: [ev] };
 }

package/dist/hitl/gateLedger.d.ts

@@ -18,14 +18,10 @@ export interface AskAnsweredOutput {
 export declare function durableSeqOf(ev: object): string | undefined;
 export declare const BODY_SEQ_OTHER_AXIS_EVENTS: readonly string[];
 export declare function hasLedgerPositionKey(ev: object): boolean;
-export declare const PREAMBLE_APPROVALS_MAX_ENTRIES = 4096;
 export interface GateLedger {
     noteSeq(ev: AgentEvent): void;
     lastSeq(): string | undefined;
     forgetRunScopedState(): void;
-    notePreambleApproval(approvalId: string): void;
-    preambleApprovals(): ReadonlySet<string>;
-    beginStreamSegment(): void;
     trackLiveCard(phaseOf: () => 'card' | 'respond', handled: Promise<void>): void;
     answeringLiveCards(): Promise<void>[];
     liveCardsSettled(): Promise<void>;

package/dist/hitl/gateLedger.js

@@ -21,7 +21,6 @@ export function hasLedgerPositionKey(ev) {
     const { id, seq } = ev;
     return (id !== undefined && id !== null) || (seq !== undefined && seq !== null);
 }
-export const PREAMBLE_APPROVALS_MAX_ENTRIES = 4096;
 export const START_ARGS_MAX_ENTRIES = 256;
 function normalizeDenyAttribution(a) {
     if (a === undefined)
@@ -108,7 +107,6 @@ export function createGateLedger() {
     let denyStampNextFsEnd = false;
     let denyStampAttribution;
     let seq;
-    const preambleApprovalIds = new Set();
     const liveCards = new Set();
     return {
         noteSeq(ev) {
@@ -125,23 +123,6 @@ export function createGateLedger() {
             startArgsByCall.clear();
             gatedStartCalls.clear();
         },
-        notePreambleApproval(approvalId) {
-            if (typeof approvalId !== 'string' || approvalId === '')
-                return;
-            preambleApprovalIds.delete(approvalId);
-            preambleApprovalIds.add(approvalId);
-            if (preambleApprovalIds.size > PREAMBLE_APPROVALS_MAX_ENTRIES) {
-                const oldest = preambleApprovalIds.values().next().value;
-                if (oldest !== undefined)
-                    preambleApprovalIds.delete(oldest);
-            }
-        },
-        preambleApprovals() {
-            return preambleApprovalIds;
-        },
-        beginStreamSegment() {
-            preambleApprovalIds.clear();
-        },
         trackLiveCard(phaseOf, handled) {
             const entry = { phaseOf, handled };
             liveCards.add(entry);

package/dist/hitl/hitlBridge.d.ts

@@ -141,6 +141,10 @@ export type FindPendingOutcome = {
 export declare function findPendingForTask(client: HitlClientLike, taskId: string, matches: (toolName: string | undefined) => boolean, opts?: {
     signal?: AbortSignal;
 }, callId?: string, identityAccepts?: (row: PendingCheckpoint) => boolean): Promise<FindPendingOutcome>;
+export declare function checkpointQueueReadingOf(row: object): {
+    readonly r: PendingCheckpoint;
+    readonly foreign: string | null;
+} | undefined;
 export declare class HitlBridge {
     private readonly client;
     private readonly taskId;
@@ -156,6 +160,7 @@ export declare class HitlBridge {
         decision: 'approve';
         updatedInput?: unknown;
         remember?: 'session' | undefined;
+        feedback?: string | undefined;
     } | HitlDecideDenyOutcome, toolUseID?: string, opts?: {
         signal?: AbortSignal;
         operation?: DecideOperationSpan;

package/dist/hitl/hitlBridge.js

@@ -270,11 +270,8 @@ export async function findPendingForTask(client, taskId, matches, opts, callId,
         return { ok: false, reason: `approvals.list failed: ${t.reason}` };
     }
     const readings = rows.flatMap((r) => {
-        const sort = checkpointQueueRowSortOf(r);
-        if (sort === 'excluded')
-            return [];
-        const cp = r;
-        return [{ r: cp, foreign: sort === 'unreadable' ? QUEUE_ROW_FAMILY_UNREADABLE_GATE : askParkForeignGateKind(cp) }];
+        const x = checkpointQueueReadingOf(r);
+        return x === undefined ? [] : [x];
     });
     const decidable = readings.filter((x) => x.foreign === null).map((x) => x.r);
     const identityRow = callId !== undefined
@@ -313,6 +310,13 @@ export async function findPendingForTask(client, taskId, matches, opts, callId,
         return { ok: false, reason: checkpointRowBarSentence(bar), code: 'row_unresumable', rowVerdict: bar };
     return { ok: true, pending, gatedCallId: pending.toolCallId ?? pending.boundCallId ?? undefined };
 }
+export function checkpointQueueReadingOf(row) {
+    const sort = checkpointQueueRowSortOf(row);
+    if (sort === 'excluded')
+        return undefined;
+    const cp = row;
+    return { r: cp, foreign: sort === 'unreadable' ? QUEUE_ROW_FAMILY_UNREADABLE_GATE : askParkForeignGateKind(cp) };
+}
 export class HitlBridge {
     client;
     taskId;
@@ -381,6 +385,7 @@ export class HitlBridge {
                 ...this.bindingOf(pending),
                 ...(outcome.updatedInput !== undefined ? { updatedInput: outcome.updatedInput } : {}),
                 ...(outcome.remember !== undefined ? { remember: outcome.remember } : {}),
+                ...(outcome.feedback !== undefined ? { feedback: outcome.feedback } : {}),
             }
             : {
                 decision: 'deny',
@@ -594,12 +599,11 @@ function bindingMismatchReading(e) {
         return 'not';
     const code = readWireErrorCodeReading(e);
     const nameReading = protocolErrorNameReading(e);
-    const family = (code.state === 'code' && (code.code === APPROVAL_BINDING_MISMATCH || code.code === CHECKPOINT_INVALID_OUTCOME)) ||
-        (nameReading.state === 'named' && nameReading.name === PROTOCOL_ERROR_NAME.ApprovalBindingMismatchError);
+    const codeReclassified = code.state === 'code' && code.code === CHECKPOINT_INVALID_OUTCOME;
+    const family = (code.state === 'code' && code.code === APPROVAL_BINDING_MISMATCH) ||
+        (!codeReclassified && nameReading.state === 'named' && nameReading.name === PROTOCOL_ERROR_NAME.ApprovalBindingMismatchError);
     if (family)
         return 'mismatch';
-    if (nameReading.state === 'sdk-instance' && code.state !== 'code')
-        return 'unreadable';
     if (code.state === 'unreadable')
         return 'unreadable';
     return 'not';

package/dist/hitl/hitlHostSurface.d.ts

@@ -28,6 +28,7 @@ export declare const CANCEL_DENY_WARN_TEXT = "could not cancel the pending quest
 export declare const REMEMBER_NOT_APPLIED_WARN_TEXT = "this session-wide allow was not remembered by the worker \u2014 you will be asked again for this tool";
 export declare const EDIT_NOT_FORWARDED_WARN_TEXT = "your edited tool input was NOT forwarded \u2014 the tool is running with the ORIGINAL input you saw before editing";
 export declare function surfaceRememberNotApplied(): void;
+export declare function surfaceAllowNoteNotCarried(sentence: string): void;
 export declare function surfaceEditNotForwarded(): void;
 export declare const APPROVAL_PARKING_WARN_TEXT = "This approval is being parked; answer it again on the parked card when it appears.";
 export declare function approvalParkingNoticeText(retryAfterMs?: number): string;

package/dist/hitl/hitlHostSurface.js

@@ -2,6 +2,7 @@ import { createSessionSlot, DEFAULT_SESSION_KEY } from '../sessionSlot.js';
 import { hostLog } from '../host.js';
 import { unrefTimer } from '../unrefTimer.js';
 import { decideFailureNote } from '../decideFailureNote.js';
+import { editedApprovalRefusedLine } from './editedApprovalAcceptance.js';
 import { decisionRefusalSaysAskGone } from './decisionRefusal.js';
 const hostSurfaceByKey = createSessionSlot();
 const hostSurfaceMissesByKey = new Map();
@@ -73,6 +74,11 @@ const EDIT_NOT_FORWARDED_TIMEOUT_MS = 20_000;
 export function surfaceRememberNotApplied() {
     surfaceSelfClearingWarn(REMEMBER_NOT_APPLIED_KEY, REMEMBER_NOT_APPLIED_WARN_TEXT, REMEMBER_NOT_APPLIED_TIMEOUT_MS);
 }
+const ALLOW_NOTE_NOT_CARRIED_KEY = 'hitl-allow-note-not-carried';
+const ALLOW_NOTE_NOT_CARRIED_TIMEOUT_MS = 10_000;
+export function surfaceAllowNoteNotCarried(sentence) {
+    surfaceSelfClearingWarn(ALLOW_NOTE_NOT_CARRIED_KEY, sentence, ALLOW_NOTE_NOT_CARRIED_TIMEOUT_MS);
+}
 export function surfaceEditNotForwarded() {
     surfaceSelfClearingWarn(EDIT_NOT_FORWARDED_KEY, EDIT_NOT_FORWARDED_WARN_TEXT, EDIT_NOT_FORWARDED_TIMEOUT_MS);
 }
@@ -100,8 +106,7 @@ const REPLAYED_APPROVAL_LIST_UNREADABLE_TIMEOUT_MS = 10_000;
 export function surfaceReplayedApprovalListUnreadable() {
     surfaceSelfClearingWarn(REPLAYED_APPROVAL_LIST_UNREADABLE_KEY, REPLAYED_APPROVAL_LIST_UNREADABLE_WARN_TEXT, REPLAYED_APPROVAL_LIST_UNREADABLE_TIMEOUT_MS);
 }
-export const EDIT_REFUSED_ON_BLIND_ASK_WARN_TEXT = 'That approval was NOT sent: this request does not expose its tool arguments here, so an edited approval cannot be applied. ' +
-    'The request is still waiting — approve or deny it as it is.';
+export const EDIT_REFUSED_ON_BLIND_ASK_WARN_TEXT = editedApprovalRefusedLine();
 const EDIT_REFUSED_ON_BLIND_ASK_KEY = 'hitl-edit-refused-blind-ask';
 export function surfaceEditRefusedOnBlindAsk() {
     surfaceSelfClearingWarn(EDIT_REFUSED_ON_BLIND_ASK_KEY, EDIT_REFUSED_ON_BLIND_ASK_WARN_TEXT, EDIT_NOT_FORWARDED_TIMEOUT_MS);

package/dist/hitl/hostWithdrawal.d.ts

@@ -0,0 +1,15 @@
+import { type CheckpointRowBar } from '../checkpointRowVerdict.js';
+export interface HostWithdrawal {
+    readonly toldBy: 'host';
+    readonly rowVerdict: CheckpointRowBar;
+}
+export declare function hostWithdrawalOf(v: object | null | undefined): HostWithdrawal | undefined;
+export declare const PARK_QUESTION_WITHDRAW_REFUSALS: readonly ["malformed", "no_card", "not_withdrawable"];
+export type ParkQuestionWithdrawRefusal = (typeof PARK_QUESTION_WITHDRAW_REFUSALS)[number];
+export type ParkQuestionWithdrawal = {
+    readonly withdrawn: true;
+} | {
+    readonly withdrawn: false;
+    readonly refusal: ParkQuestionWithdrawRefusal;
+};
+export declare function withdrawParkQuestion(questionId: string, withdrawal: HostWithdrawal): ParkQuestionWithdrawal;

package/dist/hitl/hostWithdrawal.js

@@ -0,0 +1,38 @@
+import { slotReadOf } from '../wireFailureShape.js';
+import { checkpointRowBarOf } from '../checkpointRowVerdict.js';
+import { takeLocalQuestionWithdrawHook } from '../liveQuestionStore.js';
+import { hostLog } from '../host.js';
+export function hostWithdrawalOf(v) {
+    try {
+        if (typeof v !== 'object' || v === null)
+            return undefined;
+        const told = slotReadOf(v, 'toldBy');
+        if (told.presence !== 'present' || told.value !== 'host')
+            return undefined;
+        if (slotReadOf(v, 'rowVerdict').presence !== 'present')
+            return undefined;
+        const bar = checkpointRowBarOf(v);
+        return bar === undefined ? undefined : Object.freeze({ toldBy: 'host', rowVerdict: bar });
+    }
+    catch {
+        return undefined;
+    }
+}
+export const PARK_QUESTION_WITHDRAW_REFUSALS = Object.freeze(['malformed', 'no_card', 'not_withdrawable']);
+const WITHDRAWN = Object.freeze({ withdrawn: true });
+const refused = (refusal) => Object.freeze({ withdrawn: false, refusal });
+export function withdrawParkQuestion(questionId, withdrawal) {
+    const told = hostWithdrawalOf(withdrawal);
+    if (told === undefined)
+        return refused('malformed');
+    const taken = takeLocalQuestionWithdrawHook(questionId);
+    if (taken === 'no_card' || taken === 'not_withdrawable')
+        return refused(taken);
+    try {
+        taken(told);
+    }
+    catch (e) {
+        hostLog('debug', `hostWithdrawal: withdraw-hook-threw card=${questionId} thrown=${e instanceof Error ? e.name : typeof e}`);
+    }
+    return WITHDRAWN;
+}

package/dist/hitl/livePendingAsk.js

@@ -1,10 +1,10 @@
 import { isApprovalRequestFrameV1 } from '@sema-agent/sdk';
-import { appendOwnElement } from '../ownKey.js';
+import { appendOwnElement, readOwnDataNonEmptyString } from '../ownKey.js';
 import { readRequiresRealApproval } from './approvalCardReading.js';
 import { pendingRowIsOfSession } from './parkRowDelegation.js';
 import { approvalLiveFaceOf, liveFaceCarried } from './approvalLiveFace.js';
 import { THROWN_SLOT_UNREADABLE, readThrownSlot } from '../wireFailureShape.js';
-import { isToolApprovalFrame, surfaceToolApprovalFrameAndRespond, } from './toolApprovalWire.js';
+import { isToolApprovalFrame, surfaceApprovalFrameWithId, } from './toolApprovalWire.js';
 function nonEmptyString(v) {
     return typeof v === 'string' && v !== '';
 }
@@ -24,7 +24,9 @@ function snapshotMembers(raw) {
     }
     return raw.length === length ? out : undefined;
 }
-function openingFrameOf(f) {
+function openingFrameOf(f, approvalId) {
+    if (typeof f !== 'object' || f === null || readOwnDataNonEmptyString(f, 'approvalId') !== approvalId)
+        return undefined;
     if (isToolApprovalFrame(f))
         return f.type === 'tool_approval' ? f : undefined;
     return isApprovalRequestFrameV1(f) ? f : undefined;
@@ -54,19 +56,19 @@ export function readLivePendingRows(body) {
             continue;
         }
         const o = item;
-        if (!nonEmptyString(o.approvalId) || !nonEmptyString(o.toolName) || !nonNegativeFinite(o.ts) || !nonNegativeFinite(o.expiresAtMs)) {
+        const approvalId = readOwnDataNonEmptyString(o, 'approvalId');
+        if (approvalId === undefined || !nonEmptyString(o.toolName) || !nonNegativeFinite(o.ts) || !nonNegativeFinite(o.expiresAtMs)) {
             dropped++;
             continue;
         }
-        if (seen.has(o.approvalId)) {
+        if (seen.has(approvalId)) {
             dropped++;
             continue;
         }
-        seen.add(o.approvalId);
-        const opening = openingFrameOf(o.frame);
-        const frame = opening !== undefined && opening.approvalId === o.approvalId ? opening : undefined;
-        rows.push({
-            approvalId: o.approvalId,
+        seen.add(approvalId);
+        const frame = openingFrameOf(o.frame, approvalId);
+        appendOwnElement(rows, {
+            approvalId,
             toolName: o.toolName,
             ts: o.ts,
             expiresAtMs: o.expiresAtMs,
@@ -147,13 +149,12 @@ export function livePendingRowToApprovalFrame(row) {
     };
 }
 export function surfaceSuspendedAskAndRespond(row, respond, signal, lane) {
-    if (row.frame !== undefined) {
-        return surfaceToolApprovalFrameAndRespond(row.frame, respond, undefined, signal, lane);
+    const frame = row.frame;
+    const approvalId = row.approvalId;
+    if (frame !== undefined) {
+        return surfaceApprovalFrameWithId(frame, approvalId, respond, undefined, signal, lane, undefined);
     }
-    return surfaceToolApprovalFrameAndRespond(livePendingRowToApprovalFrame(row), respond, undefined, signal, {
-        ...lane,
-        argsUnavailable: true,
-    });
+    return surfaceApprovalFrameWithId(livePendingRowToApprovalFrame(row), approvalId, respond, undefined, signal, { ...lane, argsUnavailable: true }, undefined);
 }
 const TRACKER_UNSEEN_CLAIMS_MAX = 512;
 export function createSuspendedAskTracker(filter) {

package/dist/hitl/localAllowRule.js

@@ -1,4 +1,5 @@
 import { reasonOfThrownWithSink } from '../hostCallbackGuard.js';
+import { isWholeToolRuleValue } from './permissionRuleScope.js';
 const BASH_TOOL_NAME_FOR_RULES = 'Bash';
 export function parseLocalAllowRule(rule, expectedToolName, deps) {
     if (typeof rule !== 'string' || rule === '') {
@@ -14,7 +15,7 @@ export function parseLocalAllowRule(rule, expectedToolName, deps) {
     if (typeof value.toolName !== 'string' || value.toolName === '') {
         return { ok: false, error: 'rule text carries no tool name' };
     }
-    if (value.ruleContent === undefined || value.ruleContent === '') {
+    if (isWholeToolRuleValue(value)) {
         return {
             ok: false,
             error: 'candidate is a whole-tool allow rule (broader than this ask) — not offered locally',

package/dist/hitl/noAllowCause.d.ts

@@ -1,4 +1,4 @@
-export type NoAllowCause = 'no_allow_rule' | 'ask_rule' | 'engine_ask_rule' | 'budget' | 'other';
+export type NoAllowCause = 'no_allow_rule' | 'ask_rule' | 'engine_ask_rule' | 'budget' | 'whole_tool_rule_only' | 'other';
 export interface RuleLadderNoAllowFacts {
     readonly allowed?: boolean;
     readonly denied?: boolean;

package/dist/hitl/noAllowCause.js

@@ -1,4 +1,4 @@
-import { automaticAnswerVerdict } from './automaticAnswerVerdict.js';
+import { askLevelVerdict } from './automaticAnswerVerdict.js';
 function ladderSays(ladder, key) {
     if (typeof ladder !== 'object' || ladder === null)
         return false;
@@ -17,11 +17,13 @@ export function noAllowCauseOf(card, ladder) {
         return 'ask_rule';
     if (ladderSays(ladder, 'budgetExhausted'))
         return 'budget';
-    const standing = automaticAnswerVerdict(card, 'standing_rule');
+    const standing = askLevelVerdict(card, 'standing_rule');
     if (standing.kind === 'must_ask' && (standing.askClass === 'ask_rule' || standing.origin === 'ask_rule')) {
         return ladderSays(ladder, 'noAskRuleMatched') || ladderSays(ladder, 'noRuleMatched') ? 'engine_ask_rule' : 'ask_rule';
     }
     if (ladderSays(ladder, 'noRuleMatched') && standing.kind === 'may_answer')
         return 'no_allow_rule';
+    if (standing.kind === 'may_answer')
+        return 'whole_tool_rule_only';
     return 'other';
 }

package/dist/hitl/parkExpiryJudgements.js

@@ -1,11 +1,36 @@
+import { isApprovalCompleteFrameV1 } from '@sema-agent/sdk';
 import { APPROVAL_EXPIRED } from '../engineErrorCodes.js';
 import { approvalCompleteParked } from './approvalCompleteParked.js';
 export function classifyApprovalCompleteFrame(frame) {
     if (typeof frame !== 'object' || frame === null)
         return null;
     const f = frame;
-    if (f.type !== 'tool_approval_complete')
+    const type = f.type;
+    if (type === 'tool_approval_complete')
+        return dispositionOf(frame, f);
+    if (type === 'approval_complete')
+        return presentedFamilyDisposition(frame);
+    return null;
+}
+function presentedFamilyDisposition(frame) {
+    try {
+        const snapshot = ownDataSnapshot(frame);
+        return isApprovalCompleteFrameV1(snapshot) ? dispositionOf(snapshot, snapshot) : null;
+    }
+    catch {
         return null;
+    }
+}
+function ownDataSnapshot(frame) {
+    const snapshot = Object.create(null);
+    for (const key of Object.getOwnPropertyNames(frame)) {
+        const d = Object.getOwnPropertyDescriptor(frame, key);
+        if (d !== undefined && Object.hasOwn(d, 'value'))
+            snapshot[key] = d.value;
+    }
+    return snapshot;
+}
+function dispositionOf(frame, f) {
     const outcome = f.outcome;
     if (outcome === 'allowed' || outcome === 'denied')
         return 'settled';

package/dist/hitl/parkOwnership.d.ts

@@ -6,5 +6,7 @@ export interface ParkOwnershipDeps {
     isOwnRun?: (taskIdTail: string) => boolean;
 }
 export declare function pendingRowIsOwnedByThisSession(row: PendingCheckpoint, deps?: ParkOwnershipDeps): boolean;
+export declare function pendingRowOwnershipOf(row: object, deps?: ParkOwnershipDeps): 'owned' | 'foreign' | 'unknown';
+export declare function usableAskQuestions(value: unknown): AskQuestion[] | null;
 export declare function askQuestionsFromPending(pending: PendingCheckpoint): AskQuestion[] | null;
 export declare function isHitlSafetyErrorLike(e: unknown): boolean;

package/dist/hitl/parkOwnership.js

@@ -3,31 +3,71 @@ import { rowIdTail } from '../workflow.js';
 import { hostSessionFor } from '../host.js';
 import { DEFAULT_SESSION_KEY } from '../sessionSlot.js';
 import { pendingRowIsOfSession } from './parkRowDelegation.js';
+import { slotReadOf } from '../wireFailureShape.js';
 export function pendingRowIsOwnedByThisSession(row, deps) {
+    return ownershipVerdictOf(row, deps) === 'owned';
+}
+export function pendingRowOwnershipOf(row, deps) {
+    try {
+        return ownershipVerdictOf(row, deps);
+    }
+    catch {
+        return 'unknown';
+    }
+}
+function ownershipVerdictOf(row, deps) {
     const sessionKey = deps?.sessionKey ?? DEFAULT_SESSION_KEY;
     const rowTaskId = typeof row.taskId === 'string' ? row.taskId : '';
     if (rowTaskId.length > 0) {
         const tail = rowIdTail(rowTaskId);
         if (deps?.isOwnRun !== undefined && deps.isOwnRun(tail))
-            return true;
+            return 'owned';
         if (sessionKey === DEFAULT_SESSION_KEY && isOwnEngineRun(tail))
-            return true;
+            return 'owned';
     }
     const currentSessionId = deps?.currentSessionId ?? (() => hostSessionFor(sessionKey)?.currentSessionId());
     const sessionId = currentSessionId();
     if (typeof sessionId !== 'string' || sessionId.length === 0)
+        return 'unknown';
+    if (pendingRowIsOfSession(row, sessionId))
+        return 'owned';
+    return rowIsProvablyForeign(row, sessionId) ? 'foreign' : 'unknown';
+}
+function rowIsProvablyForeign(row, selfSessionId) {
+    const own = slotReadOf(row, 'sessionId');
+    if (own.presence !== 'present' || typeof own.value !== 'string' || own.value === '' || own.value === selfSessionId)
+        return false;
+    const agent = slotReadOf(row, 'agent');
+    if (agent.presence === 'absent')
+        return true;
+    if (agent.presence !== 'present' || typeof agent.value !== 'object' || agent.value === null)
         return false;
-    return pendingRowIsOfSession(row, sessionId);
+    for (const key of ['parentSessionId', 'rootSessionId']) {
+        const link = slotReadOf(agent.value, key);
+        if (link.presence === 'absent')
+            continue;
+        if (link.presence !== 'present' || typeof link.value !== 'string' || link.value === selfSessionId)
+            return false;
+    }
+    return true;
+}
+export function usableAskQuestions(value) {
+    if (!Array.isArray(value) || value.length === 0)
+        return null;
+    for (let i = 0; i < value.length; i++) {
+        if (!Object.hasOwn(value, i))
+            return null;
+        const q = value[i];
+        if (typeof q !== 'object' || q === null || typeof q.question !== 'string')
+            return null;
+    }
+    return value;
 }
 export function askQuestionsFromPending(pending) {
     const input = pending.input;
     if (typeof input !== 'object' || input === null)
         return null;
-    const qs = input.questions;
-    if (!Array.isArray(qs) || qs.length === 0)
-        return null;
-    const ok = qs.every(q => typeof q === 'object' && q !== null && typeof q.question === 'string');
-    return ok ? qs : null;
+    return usableAskQuestions(input.questions);
 }
 export function isHitlSafetyErrorLike(e) {
     return typeof e === 'object' && e !== null && e.name === 'HitlSafetyError';