@sema-agent/client-core 0.109.0 → 0.111.0

package/dist/hitl/localAllowRedemption.js

@@ -0,0 +1,256 @@
+import { displayUntrusted } from '../displayUntrusted.js';
+import { readOwnDataValue } from '../ownKey.js';
+import { layerAdmissionWord } from '../settingsLayerAdmission.js';
+import { parseLocalAllowRule } from './localAllowRule.js';
+import { classifyRulesFailure, classifySkippedReason, readCcImportRedeemCounts, } from './persistedRulesWire.js';
+export const LOCAL_ALLOW_NOT_REDEEMABLE_REASONS = Object.freeze(['managed_only', 'tighten_only', 'no_scope_root', 'no_consent', 'road_closed']);
+export const LOCAL_ALLOW_UNKNOWN_CAUSES = Object.freeze(['input_unreadable', 'policy_unreadable', 'consent_unreadable', 'road_unknown']);
+function verdict(v) {
+    return Object.freeze({ ...v });
+}
+const notRedeemable = (reason) => verdict({ kind: 'not_redeemable', reason });
+const unknownBecause = (cause) => verdict({ kind: 'unknown', cause });
+const PROJECT_SCOPE_PREFIX = 'project:';
+const ALLOW_BEHAVIOR = 'allow';
+const MANAGED_LAYER = 'policySettings';
+const DETAIL_SHOWN_MAX = 400;
+function policyStep(v) {
+    if (v === true)
+        return notRedeemable('managed_only');
+    if (v === false)
+        return undefined;
+    return unknownBecause('policy_unreadable');
+}
+function scopeRootOf(v) {
+    return typeof v === 'string' && v !== '' ? v : undefined;
+}
+function storeRowConsents(row, rule, scopeRoot) {
+    if (typeof row !== 'object' || row === null)
+        return false;
+    const behavior = readOwnDataValue(row, 'behavior');
+    const text = readOwnDataValue(row, 'rule');
+    const scope = readOwnDataValue(row, 'scope');
+    return behavior === ALLOW_BEHAVIOR && text === rule && (scope === 'global' || scope === PROJECT_SCOPE_PREFIX + scopeRoot);
+}
+function consentRecorded(store, rule, scopeRoot) {
+    if (typeof store !== 'object' || store === null)
+        return undefined;
+    const ok = readOwnDataValue(store, 'ok');
+    if (ok !== true)
+        return undefined;
+    const rows = readOwnDataValue(store, 'rules');
+    if (!Array.isArray(rows))
+        return undefined;
+    for (let i = 0; i < rows.length; i++) {
+        if (storeRowConsents(readOwnDataValue(rows, String(i)), rule, scopeRoot))
+            return true;
+    }
+    return false;
+}
+function roadStep(road) {
+    if (road === 'true')
+        return verdict({ kind: 'redeemable', via: 'consent' });
+    if (road === 'false' || road === 'absent')
+        return notRedeemable('road_closed');
+    return unknownBecause('road_unknown');
+}
+export function localAllowRedeemability(input) {
+    try {
+        if (typeof input !== 'object' || input === null)
+            return unknownBecause('input_unreadable');
+        const subject = readOwnDataValue(input, 'subject');
+        if (subject !== 'offered' && subject !== 'declared')
+            return unknownBecause('input_unreadable');
+        const source = readOwnDataValue(input, 'source');
+        if (!(subject === 'declared' && source === MANAGED_LAYER)) {
+            const policy = policyStep(readOwnDataValue(input, 'managedRulesOnly'));
+            if (policy !== undefined)
+                return policy;
+        }
+        const scopeRoot = scopeRootOf(readOwnDataValue(input, 'scopeRoot'));
+        if (subject === 'offered') {
+            if (scopeRoot === undefined)
+                return notRedeemable('no_scope_root');
+            return roadStep(readOwnDataValue(input, 'road'));
+        }
+        const workspace = readOwnDataValue(input, 'workspace');
+        let word;
+        try {
+            word = layerAdmissionWord(source, workspace, 'permissions', ALLOW_BEHAVIOR);
+        }
+        catch {
+            return unknownBecause('input_unreadable');
+        }
+        if (word === 'admitted')
+            return verdict({ kind: 'redeemable', via: 'layer' });
+        if (word === 'tighten_only')
+            return notRedeemable('tighten_only');
+        if (scopeRoot === undefined)
+            return notRedeemable('no_scope_root');
+        const rule = readOwnDataValue(input, 'rule');
+        if (typeof rule !== 'string' || rule === '')
+            return unknownBecause('input_unreadable');
+        const consent = consentRecorded(readOwnDataValue(input, 'store'), rule, scopeRoot);
+        if (consent === undefined)
+            return unknownBecause('consent_unreadable');
+        return consent ? verdict({ kind: 'redeemable', via: 'consent' }) : notRedeemable('no_consent');
+    }
+    catch {
+        return unknownBecause('input_unreadable');
+    }
+}
+export const LOCAL_ALLOW_REDEMPTION_REFUSALS = Object.freeze([
+    'managed_only',
+    'no_scope_root',
+    'rule_shape',
+    'request_refused',
+    'preview_mismatch',
+    'engine_refused',
+    'ticket_dead',
+]);
+export const LOCAL_ALLOW_REDEMPTION_UNAVAILABLE_CAUSES = Object.freeze(['road_closed', 'road_unknown', 'policy_unreadable', 'input_unreadable', 'prepare_failed']);
+export const LOCAL_ALLOW_REDEMPTION_UNKNOWN_CAUSES = Object.freeze(['redeem_unsettled', 'receipt_unreadable']);
+function singleRuleLayerContent(canonical) {
+    return JSON.stringify({ permissions: { allow: [canonical] } });
+}
+function receipt(r) {
+    return Object.freeze({ ...r });
+}
+function detailOf(text) {
+    if (typeof text !== 'string')
+        return {};
+    const shown = displayUntrusted(text, { max: DETAIL_SHOWN_MAX });
+    return shown.trim() !== '' ? { detail: shown } : {};
+}
+const JUDGED_RECEIPT = {
+    managed_only: { kind: 'refused', reason: 'managed_only' },
+    no_scope_root: { kind: 'refused', reason: 'no_scope_root' },
+    road_closed: { kind: 'unavailable', cause: 'road_closed' },
+    road_unknown: { kind: 'unavailable', cause: 'road_unknown' },
+    policy_unreadable: { kind: 'unavailable', cause: 'policy_unreadable' },
+    input_unreadable: { kind: 'unavailable', cause: 'input_unreadable' },
+    tighten_only: { kind: 'unavailable', cause: 'input_unreadable' },
+    no_consent: { kind: 'unavailable', cause: 'input_unreadable' },
+    consent_unreadable: { kind: 'unavailable', cause: 'input_unreadable' },
+};
+function previewSingle(prep, scopeRoot) {
+    const preview = typeof prep === 'object' && prep !== null ? readOwnDataValue(prep, 'preview') : undefined;
+    if (typeof preview !== 'object' || preview === null)
+        return { mismatch: true };
+    const skipped = readOwnDataValue(preview, 'skipped');
+    if (Array.isArray(skipped) && skipped.length > 0) {
+        const first = readOwnDataValue(skipped, '0');
+        const reason = typeof first === 'object' && first !== null ? readOwnDataValue(first, 'reason') : undefined;
+        return { mismatch: true, skipped: typeof reason === 'string' ? classifySkippedReason(reason).text : '' };
+    }
+    if (!Array.isArray(skipped))
+        return { mismatch: true };
+    const candidates = readOwnDataValue(preview, 'candidates');
+    if (!Array.isArray(candidates) || candidates.length !== 1)
+        return { mismatch: true };
+    const c = readOwnDataValue(candidates, '0');
+    if (typeof c !== 'object' || c === null)
+        return { mismatch: true };
+    const behavior = readOwnDataValue(c, 'behavior');
+    const rule = readOwnDataValue(c, 'rule');
+    const scope = readOwnDataValue(c, 'scope');
+    const kind = typeof scope === 'object' && scope !== null ? readOwnDataValue(scope, 'kind') : undefined;
+    const root = typeof scope === 'object' && scope !== null ? readOwnDataValue(scope, 'root') : undefined;
+    if (behavior !== ALLOW_BEHAVIOR || typeof rule !== 'string' || kind !== 'project' || root !== scopeRoot)
+        return { mismatch: true };
+    return { rule };
+}
+export async function redeemReadOnlyRuleOffer(facade, input, opts) {
+    let canonical;
+    let offered;
+    let scopeRoot;
+    let settingsPath;
+    try {
+        if (typeof input !== 'object' || input === null)
+            return receipt({ kind: 'unavailable', cause: 'input_unreadable' });
+        const judged = localAllowRedeemability({
+            subject: 'offered',
+            managedRulesOnly: readOwnDataValue(input, 'managedRulesOnly'),
+            scopeRoot: readOwnDataValue(input, 'scopeRoot'),
+            road: readOwnDataValue(input, 'road'),
+        });
+        if (judged.kind !== 'redeemable')
+            return receipt(JUDGED_RECEIPT[judged.kind === 'not_redeemable' ? judged.reason : judged.cause]);
+        scopeRoot = readOwnDataValue(input, 'scopeRoot');
+        const path = readOwnDataValue(input, 'settingsPath');
+        if (typeof path !== 'string' || path === '')
+            return receipt({ kind: 'unavailable', cause: 'input_unreadable' });
+        settingsPath = path;
+        const rule = readOwnDataValue(input, 'rule');
+        const expected = readOwnDataValue(input, 'expectedToolName');
+        const deps = readOwnDataValue(input, 'deps');
+        if (typeof rule !== 'string' || deps === undefined || (expected !== undefined && typeof expected !== 'string'))
+            return receipt({ kind: 'unavailable', cause: 'input_unreadable' });
+        const parsed = parseLocalAllowRule(rule, expected, deps);
+        if (!parsed.ok)
+            return receipt({ kind: 'refused', reason: 'rule_shape', ...detailOf(parsed.error) });
+        canonical = parsed.canonical;
+        offered = rule;
+    }
+    catch {
+        return receipt({ kind: 'unavailable', cause: 'input_unreadable' });
+    }
+    const signal = opts?.signal;
+    let prep;
+    try {
+        prep = await facade.ccImportPrepare([{ layer: 'localSettings', path: settingsPath, root: scopeRoot, content: singleRuleLayerContent(canonical) }], signal !== undefined ? { signal } : undefined);
+    }
+    catch (e) {
+        const f = classifyRulesFailure(e);
+        if (f.kind === 'lane-unavailable' || f.kind === 'route-missing')
+            return receipt({ kind: 'unavailable', cause: 'road_closed' });
+        if (f.kind === 'body-shape' || f.kind === 'field-refused' || f.kind === 'too-many-candidates' || f.kind === 'forbidden' || f.kind === 'operators-unconfigured') {
+            return receipt({ kind: 'refused', reason: 'request_refused' });
+        }
+        return receipt({ kind: 'unavailable', cause: 'prepare_failed' });
+    }
+    let ticket;
+    let storedRule;
+    try {
+        const single = previewSingle(prep, scopeRoot);
+        if ('mismatch' in single) {
+            return receipt(single.skipped !== undefined ? { kind: 'refused', reason: 'engine_refused', ...detailOf(single.skipped) } : { kind: 'refused', reason: 'preview_mismatch' });
+        }
+        if (single.rule !== canonical && single.rule !== offered)
+            return receipt({ kind: 'refused', reason: 'preview_mismatch' });
+        storedRule = single.rule;
+        const t = readOwnDataValue(prep, 'ticket');
+        if (typeof t !== 'string' || t === '')
+            return receipt({ kind: 'refused', reason: 'preview_mismatch' });
+        ticket = t;
+    }
+    catch {
+        return receipt({ kind: 'refused', reason: 'preview_mismatch' });
+    }
+    let body;
+    try {
+        body = await facade.ccImportRedeem(ticket, signal !== undefined ? { signal } : undefined);
+    }
+    catch (e) {
+        const f = classifyRulesFailure(e);
+        if (f.kind === 'ticket-dead')
+            return receipt({ kind: 'refused', reason: 'ticket_dead' });
+        if (f.kind === 'lane-unavailable')
+            return receipt({ kind: 'unavailable', cause: 'road_closed' });
+        return receipt({ kind: 'unknown', cause: 'redeem_unsettled' });
+    }
+    const counts = readCcImportRedeemCounts(body);
+    if (counts === null)
+        return receipt({ kind: 'unknown', cause: 'receipt_unreadable' });
+    const refusedRow = counts.refused?.[0];
+    if (refusedRow !== undefined)
+        return receipt({ kind: 'refused', reason: 'engine_refused', ...detailOf(refusedRow.detail) });
+    if (counts.indeterminate.length > 0)
+        return receipt({ kind: 'unknown', cause: 'redeem_unsettled' });
+    const scope = PROJECT_SCOPE_PREFIX + scopeRoot;
+    if (counts.persisted === 1 && counts.deduped === 0)
+        return receipt({ kind: 'applied', outcome: 'persisted', rule: storedRule, scope });
+    if (counts.deduped === 1 && counts.persisted === 0)
+        return receipt({ kind: 'applied', outcome: 'already_live', rule: storedRule, scope });
+    return receipt({ kind: 'unknown', cause: 'receipt_unreadable' });
+}

package/dist/hitl/parkResolver.js

@@ -1,15 +1,16 @@
-import { putOwnKey, readOwnDataValue } from '../ownKey.js';
+import { guardedRead, putOwnKey, readOwnDataValue } from '../ownKey.js';
 import { HitlBridge, NO_QUESTION_OVERLAY_REASON, findPendingForTask, isNoDecisionSurfaceReason, } from './hitlBridge.js';
 import { approvalResolutionDetail, approvalResolutionStatusTag, directSafetyStopOf, resolutionOfDecisionFailure } from './approvalResolution.js';
 import { readDecisionRefusalAsk } from './decisionRefusal.js';
 import { publishQuestionFrame, registerLocalQuestionResponder, hasQuestionOverlay, } from '../liveQuestionStore.js';
 import { hostLog } from '../host.js';
 import { surfaceFsApprovalAndDecide } from './toolApprovalWire.js';
-import { INTERRUPT_DENY_REASON, observeCancelByDeny } from './hitlHostSurface.js';
+import { INTERRUPT_DENY_REASON, interruptDenyLifetime, observeCancelByDeny } from './hitlHostSurface.js';
 import { denyAttributionOf, flushHeldWithInterruptRewrite, isAskTool } from './frameRouter.js';
 import { invokeHostCallbackIsolated } from '../hostCallbackGuard.js';
 import { inheritFrameBinding } from '../frameBinding.js';
 import { approvalCallKey, askGateQuestionId } from './gateIdentity.js';
+import { parkQuestionFrameBits, sourceGenerationNow } from './screenCardCarriers.js';
 import { usableAskQuestions } from './parkOwnership.js';
 import { readDecideReceipt } from '../decideReceipt.js';
 import { decideFailureNote } from '../decideFailureNote.js';
@@ -65,6 +66,7 @@ async function surfaceGateAndDecide(deps, taskId, askArgsByCall, signal, parkGat
     if (!hasQuestionOverlay()) {
         return { kind: 'not_sent', lane: 'ask', cause: 'card_unavailable', detail: NO_QUESTION_OVERLAY_REASON };
     }
+    const sourceGeneration = sourceGenerationNow(deps);
     const found = await findPendingForTask(deps.client, taskId, isAskTool, signal ? { signal } : undefined, parkGatedCallId, (row) => isAskTool(typeof row.toolName === 'string' ? row.toolName : undefined));
     if (!found.ok)
         return { kind: 'not_sent', lane: 'ask', cause: found.code ?? 'fetch_failed', ...(found.reason !== '' ? { detail: found.reason } : {}), ...(found.rowVerdict !== undefined ? { rowVerdict: found.rowVerdict } : {}) };
@@ -86,11 +88,17 @@ async function surfaceGateAndDecide(deps, taskId, askArgsByCall, signal, parkGat
         };
     }
     const questionId = askGateQuestionId(approvalCallKey(gatedCallId, taskId));
+    let withdrawn;
     const answer = await new Promise(resolve => {
         const unregister = registerLocalQuestionResponder(questionId, async (_id, a) => {
             cleanup();
             resolve(a);
             return { ok: true };
+        }, (w) => {
+            withdrawn = w;
+            cleanup();
+            publishQuestionFrame({ type: 'question_complete', questionId });
+            resolve(null);
         });
         const onAbort = () => {
             cleanup();
@@ -107,11 +115,15 @@ async function surfaceGateAndDecide(deps, taskId, askArgsByCall, signal, parkGat
         }
         signal?.addEventListener('abort', onAbort, { once: true });
         onPresented?.();
-        publishQuestionFrame({ type: 'question', questionId, questions, ...(questionsFromModelCall ? { _sema_questionsFromModelCall: true } : {}) });
+        publishQuestionFrame({ type: 'question', questionId, questions, ...(questionsFromModelCall ? { _sema_questionsFromModelCall: true } : {}), ...parkQuestionFrameBits(taskId, gatedCallId, sourceGeneration) });
     });
+    if (withdrawn !== undefined) {
+        hostLog('debug', `liveHitlAskWire: question-withdrawn-by-host card=${questionId} verdict=${withdrawn.rowVerdict.kind}`);
+        return { kind: 'not_sent', ...at, cause: 'withdrawn', toldBy: withdrawn.toldBy, rowVerdict: withdrawn.rowVerdict };
+    }
     const bridge = new HitlBridge(deps.client, taskId, deps.onDecideOperation ? { onDecideOperation: deps.onDecideOperation } : undefined);
     if (answer === null) {
-        observeCancelByDeny(bridge.decideTool({ decision: 'deny', reason: INTERRUPT_DENY_REASON }, gatedCallId, undefined, pending), taskId);
+        observeCancelByDeny(bridge.decideTool({ decision: 'deny', reason: INTERRUPT_DENY_REASON }, gatedCallId, { signal: interruptDenyLifetime() }, pending), taskId);
         return { kind: 'unsettled', ...at, cause: 'interrupted' };
     }
     let declinedReceipt;
@@ -155,7 +167,7 @@ function isFetchStepNoPending(outcome) {
     return outcome.kind === 'not_sent' && outcome.cause === 'no_pending' && outcome.gatedCallId === undefined;
 }
 function isHumanDisposition(r) {
-    return r.kind === 'decided' || (r.kind === 'unsettled' && r.cause === 'interrupted') || (r.kind === 'not_sent' && r.cause === 'retracted');
+    return r.kind === 'decided' || (r.kind === 'unsettled' && r.cause === 'interrupted') || (r.kind === 'not_sent' && (r.cause === 'retracted' || r.cause === 'withdrawn'));
 }
 function failureReasonOf(r) {
     if (r.kind === 'decided')
@@ -184,6 +196,7 @@ async function surfaceParkGate(park, ctx, gatedCallId, onPresented) {
             ...(onPresented ? { onPresented } : {}),
             ...(deps.onDecideOperation ? { onDecideOperation: deps.onDecideOperation } : {}),
             ...(decidedByReading !== undefined ? { approvalDecidedBy: decidedByReading } : {}),
+            ...((read) => (typeof read === 'function' ? { engineGeneration: () => read.call(deps) } : {}))(guardedRead(() => deps.engineGeneration)),
         }, taskId, argsByCallOf(led), ctx.signal, gatedCallId, park.toolName);
         if (outcome.kind === 'decided' && outcome.decision === 'deny' && outcome.gatedCallId) {
             led.markDenied(outcome.gatedCallId, denyAttributionOf(outcome.deny));
@@ -282,7 +295,8 @@ export async function resolvePark(park, ctx) {
     if (outcome.kind !== 'decided') {
         hostLog('debug', `liveHitlAskWire: gate not decided (${outcome.kind}/${outcome.cause}: ${failureReasonOf(outcome)}) — fail-soft to suspended terminal`);
         const interrupted = outcome.kind === 'unsettled' && outcome.cause === 'interrupted';
-        const failedReason = interrupted
+        const toldByHost = outcome.kind === 'not_sent' && outcome.cause === 'withdrawn';
+        const failedReason = interrupted || toldByHost
             ? undefined
             : outcome.kind === 'not_sent' && outcome.cause === 'retracted'
                 ? 'the approval card was retracted by the host without a decision (nothing was sent; the run stays parked and remains decidable elsewhere)'
@@ -312,13 +326,19 @@ export async function resolvePark(park, ctx) {
     };
 }
 function failsoftWayOutOf(outcome) {
+    if (outcome === undefined)
+        return 'card';
+    if (typeof outcome !== 'object' || outcome === null)
+        return 'speak';
     if (outcome.kind === 'not_sent' && (outcome.cause === 'row_unresumable' || (outcome.cause === 'safety_stop' && outcome.safetyCode === 'binding_missing')))
         return 'reason';
-    if (outcome.kind === 'unsettled' && outcome.cause === 'engine_refused' && refusedParkFromError(outcome.refusal) !== null)
+    if (outcome.kind === 'unsettled' && outcome.cause === 'engine_refused' && (refusedParkFromError(outcome.refusal) !== null || outcome.refusal?.conflict === 'row_integrity'))
         return 'cancel';
+    if (outcome.kind === 'unsettled' && outcome.cause === 'engine_refused')
+        return 'speak';
     return 'card';
 }
-function failsoftReasonSentence(park, failedReason, terminal, wayOut = 'card') {
+function failsoftReasonSentence(park, failedReason, terminal, wayOut) {
     if (terminal !== undefined)
         return terminal.errorMessage;
     if (failedReason === undefined)
@@ -328,10 +348,9 @@ function failsoftReasonSentence(park, failedReason, terminal, wayOut = 'card') {
         return renderMessage(msg('approval.park.stillParked', { gate, reason: failedReason }));
     if (wayOut === 'cancel')
         return renderMessage(msg('approval.park.refusedNotResumable', { gate, reason: failedReason }));
-    return (`${park.gate === 'fs' ? 'Tool approval' : 'AskUserQuestion'} gate could not be answered: ${failedReason}` +
-        ' — the run is still parked on this approval: decide it on the card when it is shown again, or cancel the run.');
+    return renderMessage(msg(wayOut === 'speak' ? 'approval.park.resume.speak' : 'approval.park.resume.card', { gate, reason: failedReason }));
 }
-function failsoftEvents(park, ctx, gateAbortedByUser, failedReason, terminal, noDecisionSurface = false, wayOut = 'card') {
+function failsoftEvents(park, ctx, gateAbortedByUser, failedReason, terminal, noDecisionSurface, wayOut) {
     const events = [
         ...flushHeldWithInterruptRewrite(ctx.led, {
             terminal: park.pendingDone,
@@ -360,12 +379,12 @@ export function stalledTerminal(park, ctx, stalledRounds, lastStallReason, decid
             `stopped re-attaching. Your last decision was accepted; sema did not observe the run move on after it — check the ` +
             `transcript, decide the call again if the card comes back, or cancel the run.`;
         hostLog('debug', `liveHitlAskWire: ${errorMessage}`);
-        return { kind: 'failsoft', events: failsoftEvents(park, ctx, false, undefined, { errorCode: 'hitl_stalled', errorMessage }) };
+        return { kind: 'failsoft', events: failsoftEvents(park, ctx, false, undefined, { errorCode: 'hitl_stalled', errorMessage }, false, failsoftWayOutOf(undefined)) };
     }
     const reason = `the run stayed parked across ${stalledRounds} consecutive re-attach rounds without any host progress ` +
         `(last: ${lastStallReason ?? 'the engine kept parking'})`;
     hostLog('debug', `liveHitlAskWire: ${reason} — fail-soft after the round committed`);
-    return { kind: 'failsoft', events: failsoftEvents(park, ctx, false, reason) };
+    return { kind: 'failsoft', events: failsoftEvents(park, ctx, false, reason, undefined, false, failsoftWayOutOf(undefined)) };
 }
 function notifyParkReattach(ctx, attempt, max, reason) {
     invokeHostCallbackIsolated('liveHitlAskWire: onParkReattach', () => {

package/dist/hitl/persistedRulesWire.d.ts

@@ -44,6 +44,11 @@ export interface CcImportRedeemCounts {
 }
 export type CcImportReceiptOutcome = 'persisted' | 'no-op' | 'refused' | 'indeterminate';
 export declare function readCcImportRedeemCounts(body: unknown): CcImportRedeemCounts | null;
+export interface CcImportRefusedReading {
+    readonly count: number;
+    readonly rows: readonly CcImportRedeemRefused[];
+}
+export declare function refusedRowOf(counts: CcImportRedeemCounts | null | undefined): CcImportRefusedReading | null;
 export type RulesFailure = {
     kind: 'lane-unavailable';
     message: string;
@@ -189,6 +194,17 @@ export declare function classifySkippedReason(reason: string): {
     code?: string;
     text: string;
 };
+export interface CcImportSkippedGroup {
+    readonly entries: readonly string[];
+    readonly reason: string;
+    readonly code?: string;
+}
+export interface CcImportSkippedReading {
+    readonly shape: 'absent' | 'malformed' | 'read';
+    readonly groups: readonly CcImportSkippedGroup[];
+    readonly unreadable: number;
+}
+export declare function ccImportSkippedRowsOf(skipped: {} | null | undefined): CcImportSkippedReading;
 export type RulePersistOutcome = {
     state: 'unknown';
 } | {

package/dist/hitl/persistedRulesWire.js

@@ -7,7 +7,7 @@ import { hostLog } from '../host.js';
 import { msg, renderMessage } from '../i18n/translate.js';
 import { appendOwnElement, guardedRead, readOwnDataValue } from '../ownKey.js';
 import { observedPermissionRulesWrite, permissionRulesWriteAvailable } from '../permissionRulesWriteCapability.js';
-import { isToolApprovalRespondReplayed, readToolApprovalRespondAck } from './toolApprovalWire.js';
+import { isToolApprovalRespondParkedRedeemed, isToolApprovalRespondReplayed, readToolApprovalRespondAck } from './toolApprovalWire.js';
 export function persistedRulesLaneAvailable(baseUrl) {
     return engineCapTrue(baseUrl, 'permissionRules');
 }
@@ -133,6 +133,35 @@ export function readCcImportRedeemCounts(body) {
         return null;
     }
 }
+const isCount = (r) => r.presence === 'present' && typeof r.value === 'number' && Number.isSafeInteger(r.value) && r.value >= 0;
+const NO_REFUSED_ROWS = Object.freeze([]);
+const NO_REFUSED = Object.freeze({ count: 0, rows: NO_REFUSED_ROWS });
+export function refusedRowOf(counts) {
+    try {
+        if (typeof counts !== 'object' || counts === null)
+            return null;
+        if (!isCount(slotReadOf(counts, 'persisted')) || !isCount(slotReadOf(counts, 'deduped')))
+            return null;
+        const slot = slotReadOf(counts, 'refused');
+        if (slot.presence === 'absent')
+            return NO_REFUSED;
+        if (slot.presence !== 'present')
+            return null;
+        const rows = ownArrayItems(slot.value);
+        if (rows === undefined)
+            return null;
+        const kept = [];
+        for (const row of rows) {
+            if (typeof row !== 'object' || row === null)
+                return null;
+            kept.push(row);
+        }
+        return kept.length === 0 ? NO_REFUSED : Object.freeze({ count: kept.length, rows: Object.freeze(kept) });
+    }
+    catch {
+        return null;
+    }
+}
 export function classifyRulesFailure(e, context) {
     const { status, errorCode, message, retryAfterSec, committed } = wireFailureShapeOf(e);
     if (errorCode === 'capability.rule_store_required') {
@@ -635,9 +664,50 @@ export function classifySkippedReason(reason) {
         return { text };
     return { code: head, text };
 }
+const CC_IMPORT_SKIPPED_READ_BUDGET = 20_000;
+const CC_IMPORT_SKIPPED_SHOWN_MAX = 2000;
+function ccImportSkippedReading(shape, groups, unreadable) {
+    return Object.freeze({ shape, groups: Object.freeze([...groups]), unreadable });
+}
+export function ccImportSkippedRowsOf(skipped) {
+    if (skipped === undefined)
+        return ccImportSkippedReading('absent', [], 0);
+    const grouped = new Map();
+    let unreadable = 0;
+    try {
+        if (!Array.isArray(skipped))
+            return ccImportSkippedReading('malformed', [], 0);
+        const length = readOwnDataValue(skipped, 'length');
+        if (typeof length !== 'number' || !Number.isSafeInteger(length) || length < 0 || length > CC_IMPORT_SKIPPED_READ_BUDGET)
+            return ccImportSkippedReading('malformed', [], 0);
+        for (let i = 0; i < length; i++) {
+            const row = guardedRead(() => readOwnDataValue(skipped, String(i)));
+            const rule = typeof row === 'object' && row !== null ? guardedRead(() => readOwnDataValue(row, 'rule')) : undefined;
+            const reason = typeof row === 'object' && row !== null ? guardedRead(() => readOwnDataValue(row, 'reason')) : undefined;
+            if (typeof rule !== 'string' || typeof reason !== 'string') {
+                unreadable += 1;
+                continue;
+            }
+            const entries = grouped.get(reason);
+            if (entries === undefined)
+                grouped.set(reason, [displayUntrusted(rule, { max: CC_IMPORT_SKIPPED_SHOWN_MAX })]);
+            else
+                entries.push(displayUntrusted(rule, { max: CC_IMPORT_SKIPPED_SHOWN_MAX }));
+        }
+    }
+    catch {
+        return ccImportSkippedReading('malformed', [], 0);
+    }
+    const groups = [];
+    for (const [raw, entries] of grouped) {
+        const code = classifySkippedReason(raw).code;
+        groups.push(Object.freeze({ entries: Object.freeze(entries), reason: displayUntrusted(raw, { max: CC_IMPORT_SKIPPED_SHOWN_MAX }), ...(code !== undefined ? { code } : {}) }));
+    }
+    return ccImportSkippedReading('read', groups, unreadable);
+}
 export function readRulePersistOutcome(ack) {
     const parsed = readToolApprovalRespondAck(ack);
-    if (parsed === undefined || isToolApprovalRespondReplayed(parsed))
+    if (parsed === undefined || isToolApprovalRespondReplayed(parsed) || isToolApprovalRespondParkedRedeemed(parsed))
         return { state: 'unknown' };
     if (parsed.rulePersisted === true)
         return { state: 'persisted' };

package/dist/hitl/planReviewWire.d.ts

@@ -41,6 +41,8 @@ export interface PlanReviewCardView {
     readonly note?: string;
 }
 export declare function planReviewCardViewOf(frame: object | null | undefined, lang?: UiLanguage): PlanReviewCardView | undefined;
+export type PlanReviewEvidenceMove = 'same' | 'moved' | 'unknown';
+export declare function planReviewEvidenceMovedOf(shown: object | null | undefined, latest: object | null | undefined): PlanReviewEvidenceMove;
 export declare function notePlanReviewAnsweredIfDecisive(questionId: unknown, answer: QuestionAnswer | null | undefined): void;
 export { isPlanReviewPark };
 export declare function _resetArmedPlanReviewsForTest(): void;
@@ -79,6 +81,7 @@ export interface PlanReviewOutcomeMeta {
     decision: 'approve' | 'reject' | 'ask_again';
     effect: PlanReviewDecisionEffect;
     cause?: 'stored_form_unsupported';
+    questionId?: string;
 }
 export declare function planReviewOutcomeTail(taskId: string, decision: 'approve' | 'reject', effect: PlanReviewDecisionEffect, cause?: 'stored_form_unsupported'): string;
 export type PlanReviewWireClient = {