@sema-agent/client-core 0.112.1 → 0.113.0

package/dist/pluginHooksWire.js

@@ -2,10 +2,59 @@ import { displayUntrusted } from './displayUntrusted.js';
 import { appendOwnElement, readOwnDataValue } from './ownKey.js';
 import { inSlotReadOf } from './wireFailureShape.js';
 import { msg, renderMessage } from './i18n/translate.js';
-import { SETTINGS_ENGINE_OWNED_HOOK_EVENTS } from './generated/settingsSchemaTables.js';
+import { SETTINGS_ENGINE_OWNED_HOOK_EVENTS, SETTINGS_ENGINE_OWNED_HOOK_EVENT_SINCE } from './generated/settingsSchemaTables.js';
 import { SETTINGS_HOOK_EVENTS } from './generated/settingsSchemaFns.js';
-import { HOOK_SETTINGS_SOURCE_TEXT, hooksEntryUnreadKeys, hooksGroupAuthoredSource, hooksGroupUnreadKeys, hooksKeyCoordinateText, hooksSalvageMaskOf, salvageSettingsHooksEntries, } from './settingsHooksSalvage.js';
-export const ENGINE_FIRED_HOOK_EVENTS = SETTINGS_ENGINE_OWNED_HOOK_EVENTS;
+import { hostLog } from './host.js';
+import { SUPPORT_FLOOR, compareReleaseVersions } from './supportFloor.js';
+import { HOOK_SETTINGS_SOURCE_TEXT, hooksEntryContractView, hooksEntryUnreadKeys, hooksGroupAuthoredSource, hooksGroupUnreadKeys, hooksKeyCoordinateText, hooksSalvageMaskOf, isGuardHookEvent, salvageSettingsHooksEntries, } from './settingsHooksSalvage.js';
+export const SUPPORT_FLOOR_SETTINGS_CONTRACT = Object.freeze({ version: SUPPORT_FLOOR.settingsContract, basis: 'absent' });
+const CONTRACT_BASES = new Set(['reported', 'absent', 'unreadable']);
+function isCompleteVersion(v) {
+    return typeof v === 'string' && compareReleaseVersions(v, v) !== undefined;
+}
+export function contractOwnsHookEventAt(event, contractVersion) {
+    if (!isCompleteVersion(contractVersion))
+        return undefined;
+    if (typeof event !== 'string' || !SETTINGS_ENGINE_OWNED_HOOK_EVENTS.includes(event))
+        return false;
+    const order = compareReleaseVersions(contractVersion, SETTINGS_ENGINE_OWNED_HOOK_EVENT_SINCE[event]);
+    return order !== undefined && order >= 0;
+}
+function contractReadingOf(reading) {
+    if (reading === SUPPORT_FLOOR_SETTINGS_CONTRACT)
+        return SUPPORT_FLOOR_SETTINGS_CONTRACT;
+    let version;
+    let basis;
+    try {
+        if (isRecord(reading)) {
+            version = readOwnDataValue(reading, 'version');
+            basis = readOwnDataValue(reading, 'basis');
+        }
+    }
+    catch {
+        version = undefined;
+    }
+    if (isCompleteVersion(version) && typeof basis === 'string' && CONTRACT_BASES.has(basis) && (basis === 'reported' || version === SUPPORT_FLOOR.settingsContract)) {
+        return Object.freeze({ version, basis: basis });
+    }
+    hostLog('debug', `hooks-settings-contract-unreadable floor=${SUPPORT_FLOOR.settingsContract}`);
+    return Object.freeze({ version: SUPPORT_FLOOR.settingsContract, basis: 'unreadable' });
+}
+export function engineLaneOf(reading) {
+    const contract = contractReadingOf(reading);
+    return (event) => contractOwnsHookEventAt(event, contract.version) === true;
+}
+export function planSettingsContractOf(plan) {
+    let reading;
+    try {
+        const engine = isRecord(plan) ? readOwnDataValue(plan, 'engine') : undefined;
+        reading = isRecord(engine) ? readOwnDataValue(engine, 'settingsContract') : undefined;
+    }
+    catch {
+        reading = undefined;
+    }
+    return reading === undefined ? undefined : contractReadingOf(reading);
+}
 export const PLUGIN_HOOK_DISPOSITIONS = ['engine', 'shell', 'not_run'];
 export const PLUGIN_HOOK_REASONS = [
     'projected',
@@ -51,6 +100,7 @@ export const SETTINGS_HOOK_DROP_REASONS = [
     'governance_unreadable',
     'policy_disable_all',
     'no_executor',
+    'layer_degraded',
 ];
 export const HOOK_ENTRY_TYPE_WORDS = Object.freeze(['command', 'prompt', 'agent', 'http', 'mcp_tool']);
 const _hookEntryTypePins = [true, true, true, true];
@@ -148,8 +198,7 @@ function hookExecutorOf(x) {
         return judged('engine', 'projected');
     return judged(x.shellRuns ? 'shell' : 'not_run', why);
 }
-const ENGINE_EVENTS = new Set(ENGINE_FIRED_HOOK_EVENTS);
-const SHELL_OWNED_EVENTS = new Set(SETTINGS_HOOK_EVENTS.filter((e) => !ENGINE_EVENTS.has(e)));
+const CONTRACT_HOOK_EVENTS = new Set(SETTINGS_HOOK_EVENTS);
 const USER_CONFIG_REF_ONE = /\$\{user_config\.[^}]+\}/;
 const USER_CONFIG_REF_ALL = /\$\{user_config\.([^}]+)\}/g;
 function isRecord(v) {
@@ -164,8 +213,8 @@ function ownView(v) {
 function nonEmptyString(v) {
     return typeof v === 'string' && v.length > 0;
 }
-export function isEngineFiredHookEvent(event) {
-    return ENGINE_EVENTS.has(event);
+export function isEngineFiredHookEvent(event, contract) {
+    return engineLaneOf(contract)(event);
 }
 function declaresSensitive(options) {
     if (options === undefined)
@@ -239,6 +288,7 @@ export function occupancyOf(wire) {
     return out;
 }
 export function decidePluginHooks(input) {
+    const engineEvent = engineLaneOf(input.engine?.settingsContract);
     const verdicts = [];
     const excluded = [];
     const modules = [];
@@ -309,7 +359,7 @@ export function decidePluginHooks(input) {
                         appendOwnElement(verdicts, { ...key, disposition: 'not_run', reason: 'user_config_unset' });
                         return;
                     }
-                    if (!ENGINE_EVENTS.has(event)) {
+                    if (!engineEvent(event)) {
                         appendOwnElement(verdicts, {
                             ...key,
                             ...(input.shellRuns(event, entryType)
@@ -336,7 +386,7 @@ export function decidePluginHooks(input) {
                         appendOwnElement(verdicts, { ...key, disposition: ex.disposition, reason: ex.reason });
                         return;
                     }
-                    const entryUnread = isRecord(entry) ? hooksEntryUnreadKeys(event, entry, input.readerNotRead) : undefined;
+                    const entryUnread = isRecord(entry) ? hooksEntryUnreadKeys(event, entry, input.reader) : undefined;
                     if (groupSourceAuthored && (authored === 'unreadable' || entryUnread !== undefined)) {
                         appendOwnElement(verdicts, { ...key, ...fallback(event, entryType, 'source_not_authored') });
                         return;
@@ -403,7 +453,7 @@ export function decidePluginHooks(input) {
             if (v.disposition !== 'shell' || !suppressed.has(v.pluginId))
                 continue;
             v.disposition = 'not_run';
-            if (!ENGINE_EVENTS.has(v.event))
+            if (!engineEvent(v.event))
                 v.reason = 'no_executor';
         }
     }
@@ -425,6 +475,7 @@ function sessionHooksForJudge(hooks) {
     return out;
 }
 export function decideSessionHooks(input) {
+    const engineEvent = engineLaneOf(input.engine?.settingsContract);
     const out = [];
     let unreadable = 0;
     for (const src of input.sources) {
@@ -457,7 +508,7 @@ export function decideSessionHooks(input) {
                         return;
                     }
                     const shellRuns = input.shellRuns(event, type);
-                    if (!ENGINE_EVENTS.has(event)) {
+                    if (!engineEvent(event)) {
                         appendOwnElement(out, { ...key, ...(shellRuns ? { disposition: 'shell', reason: 'shell_event' } : { disposition: 'not_run', reason: 'no_executor' }) });
                         return;
                     }
@@ -493,14 +544,14 @@ function unreadKeyPathsOf(event, groupIndex, hookIndex, groupUnread, entryUnread
             appendOwnElement(out, Object.freeze(['hooks', event, groupIndex, 'hooks', hookIndex, k]));
     return Object.freeze(out);
 }
-export function filterSettingsHookGroups(source, event, groups, execFormCapable, shellRunsType, judge, readerNotRead, mask) {
+export function filterSettingsHookGroups(source, event, groups, execFormCapable, shellRunsType, judge, reader, contract, mask) {
     const drops = [];
     const verdicts = [];
     const excluded = [];
     const out = [];
     let stripped = 0;
-    const engineEvent = isEngineFiredHookEvent(event);
-    const shellOwned = !engineEvent && SHELL_OWNED_EVENTS.has(event);
+    const engineEvent = isEngineFiredHookEvent(event, contract);
+    const shellOwned = !engineEvent && CONTRACT_HOOK_EVENTS.has(event);
     groups.forEach((group, groupIndex) => {
         if (mask !== undefined && mask.groupDropped(event, groupIndex))
             return;
@@ -512,7 +563,7 @@ export function filterSettingsHookGroups(source, event, groups, execFormCapable,
                     return;
                 if (shellRunsType(isRecord(entry) && typeof entry.type === 'string' ? entry.type : undefined))
                     return;
-                appendOwnElement(drops, { source, event, groupIndex, hookIndex, reason: 'no_executor', notRun: true });
+                appendOwnElement(drops, { source, event, groupIndex, hookIndex, reason: 'no_executor', notRun: true, guard: isGuardHookEvent(event) });
             });
             return;
         }
@@ -537,7 +588,7 @@ export function filterSettingsHookGroups(source, event, groups, execFormCapable,
                     : entry.type === 'command' && carriesArgs(entry) && !execFormCapable
                         ? 'exec_form_unsupported'
                         : undefined;
-            const entryUnread = earlier === undefined && isRecord(entry) ? hooksEntryUnreadKeys(event, entry, readerNotRead) : undefined;
+            const entryUnread = earlier === undefined && isRecord(entry) ? hooksEntryUnreadKeys(event, entry, reader) : undefined;
             const sourceNotAuthored = earlier === undefined && groupSourceAuthored && (authored === 'unreadable' || entryUnread !== undefined);
             const unreadKeys = earlier === undefined && !sourceNotAuthored ? unreadKeyPathsOf(event, groupIndex, hookIndex, groupUnread ?? [], entryUnread) : [];
             const reason = earlier ?? (sourceNotAuthored ? 'source_not_authored' : unreadKeys.length > 0 ? 'key_not_read' : undefined);
@@ -551,6 +602,7 @@ export function filterSettingsHookGroups(source, event, groups, execFormCapable,
                     ...typed,
                     reason,
                     notRun: !shellRunsType(isRecord(entry) && typeof entry.type === 'string' ? entry.type : undefined),
+                    guard: isGuardHookEvent(event),
                     ...(reason === 'key_not_read' ? { unreadKeys } : {}),
                 });
                 changed = true;
@@ -611,7 +663,7 @@ export function createSettingsHookJudge(engine, shellRuns, promptAuthoredByUser,
     const seen = new Map();
     return (event, group, entry) => {
         let dk;
-        const entryKey = settingsHookEntryKey(entry);
+        const entryKey = settingsHookIdentityKey(entry);
         if (entryKey !== undefined && isRecord(group)) {
             try {
                 const { hooks: _hooks, ...rest } = group;
@@ -683,26 +735,44 @@ function settingsHookEntryKey(entry) {
         return undefined;
     }
 }
-function ccMergeRank(source) {
-    switch (source) {
-        case 'userSettings':
-            return 0;
-        case 'projectSettings':
-            return 1;
-        case 'localSettings':
-            return 2;
-        case 'flagSettings':
-            return 3;
-        case 'policySettings':
-            return 4;
+function settingsHookIdentityKey(entry) {
+    if (settingsHookEntryKey(entry) === undefined)
+        return undefined;
+    try {
+        return JSON.stringify(canonicalHookValue(entry, new Set()));
+    }
+    catch {
+        return undefined;
+    }
+}
+function canonicalHookValue(v, ancestors) {
+    if (typeof v !== 'object' || v === null)
+        return v;
+    if (ancestors.has(v))
+        throw new TypeError('cycle');
+    ancestors.add(v);
+    try {
+        if (Array.isArray(v))
+            return v.map((x) => canonicalHookValue(x, ancestors));
+        const out = Object.create(null);
+        for (const k of Object.keys(v).sort()) {
+            const x = v[k];
+            if (x !== undefined)
+                out[k] = canonicalHookValue(x, ancestors);
+        }
+        return out;
+    }
+    finally {
+        ancestors.delete(v);
     }
 }
 export function dedupeSettingsHookGroups(groups) {
-    const keysOf = [];
-    const winner = new Map();
-    for (const { source, group } of groups) {
+    const placed = new Set();
+    const out = [];
+    let removed = 0;
+    for (const { group } of groups) {
         if (!isRecord(group) || !Array.isArray(group.hooks)) {
-            appendOwnElement(keysOf, []);
+            appendOwnElement(out, group);
             continue;
         }
         let groupKey;
@@ -714,53 +784,25 @@ export function dedupeSettingsHookGroups(groups) {
         catch {
             groupKey = undefined;
         }
-        const rank = ccMergeRank(source);
-        const keys = [];
-        for (const entry of group.hooks) {
-            const entryKey = groupKey === undefined ? undefined : settingsHookEntryKey(entry);
-            const key = entryKey === undefined ? undefined : `${groupKey}\u0000${entryKey}`;
-            appendOwnElement(keys, key);
-            if (key === undefined)
-                continue;
-            const prev = winner.get(key);
-            if (prev === undefined || rank >= prev.rank)
-                winner.set(key, { entry, rank });
-        }
-        appendOwnElement(keysOf, keys);
-    }
-    const placed = new Set();
-    const out = [];
-    let removed = 0;
-    groups.forEach(({ group }, gi) => {
-        if (!isRecord(group) || !Array.isArray(group.hooks)) {
-            appendOwnElement(out, group);
-            return;
-        }
-        const keys = keysOf[gi] ?? [];
         const kept = [];
         let changed = false;
-        group.hooks.forEach((entry, hi) => {
-            const key = keys[hi];
-            if (key === undefined) {
-                appendOwnElement(kept, entry);
-                return;
-            }
-            if (placed.has(key)) {
+        for (const entry of group.hooks) {
+            const entryKey = groupKey === undefined ? undefined : settingsHookIdentityKey(entry);
+            const key = entryKey === undefined ? undefined : `${groupKey}\u0000${entryKey}`;
+            if (key !== undefined && placed.has(key)) {
                 removed++;
                 changed = true;
-                return;
+                continue;
             }
-            placed.add(key);
-            const win = winner.get(key)?.entry ?? entry;
-            if (win !== entry)
-                changed = true;
-            appendOwnElement(kept, win);
-        });
+            if (key !== undefined)
+                placed.add(key);
+            appendOwnElement(kept, entry);
+        }
         if (!changed)
             appendOwnElement(out, group);
         else if (kept.length > 0)
             appendOwnElement(out, { ...group, hooks: kept });
-    });
+    }
     return { groups: out, removed };
 }
 export function pluginHookVerdictOf(plan, pluginId, event, groupIndex, hookIndex) {
@@ -769,6 +811,50 @@ export function pluginHookVerdictOf(plan, pluginId, event, groupIndex, hookIndex
 function skipMatcherKey(matcher) {
     return matcher === undefined || matcher === null || matcher === '' || matcher === '*' ? 'null' : JSON.stringify(matcher);
 }
+function skipPairOf(entry) {
+    const names = entry.type === 'http' && Object.hasOwn(entry, 'allowedEnvVars') ? entry.allowedEnvVars : undefined;
+    const env = Array.isArray(names) && Array.from(names).every((n) => typeof n === 'string') ? names : undefined;
+    let body = entry;
+    if (env !== undefined) {
+        body = Object.create(null);
+        for (const k of Object.keys(entry))
+            if (k !== 'allowedEnvVars')
+                body[k] = entry[k];
+    }
+    const key = settingsHookIdentityKey(body);
+    return key === undefined ? undefined : env === undefined ? { key } : { key: `${key}\u0000allowedEnvVars`, env };
+}
+function localPairViewOf(event, entry, wireKeys) {
+    try {
+        if (!isRecord(entry))
+            return undefined;
+        const proto = Object.getPrototypeOf(entry);
+        const flat = Object.create(null);
+        if (proto === null || Object.getPrototypeOf(proto) === null) {
+            for (const k of Object.keys(entry)) {
+                if (k === 'plugin')
+                    continue;
+                const v = entry[k];
+                if (v !== undefined)
+                    flat[k] = v;
+            }
+            return flat;
+        }
+        const keys = new Set(wireKeys);
+        for (const k in entry)
+            keys.add(k);
+        for (const k of keys) {
+            const v = entry[k];
+            if (v !== undefined)
+                flat[k] = v;
+        }
+        const view = hooksEntryContractView(event, flat);
+        return isRecord(view) ? view : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 export function settingsHooksKeptLocally(plan, event, group, opts) {
     if (planClosedLocally(plan))
         return [];
@@ -794,7 +880,10 @@ export function settingsHooksKeptLocally(plan, event, group, opts) {
         if (layerSkipped)
             return [];
     }
-    if (!Array.isArray(hooks) || hooks.length === 0 || !ENGINE_EVENTS.has(event))
+    if (!Array.isArray(hooks) || hooks.length === 0)
+        return hooks;
+    const engineEvent = engineLaneOf(planSettingsContractOf(plan));
+    if (!engineEvent(event))
         return hooks;
     try {
         if (COMPACTION_EVENTS.has(event) && opts?.engineCompaction === 'not_performed')
@@ -806,9 +895,10 @@ export function settingsHooksKeptLocally(plan, event, group, opts) {
         const wire = ownField(planRec, 'wire');
         if (!Array.isArray(excludedList) || (wire !== undefined && !isRecord(wire)))
             return hooks;
-        if (excludedList.some((e) => settingsExclusionRowOf(e)?.event === event))
+        if (excludedList.some((e) => settingsExclusionRowOf(e, engineEvent)?.event === event))
             return [];
-        const sent = new Set();
+        const sent = new Map();
+        const wireKeys = new Set();
         const groups = isRecord(wire) ? ownField(wire, event) : undefined;
         if (Array.isArray(groups)) {
             for (const g of groups) {
@@ -821,9 +911,18 @@ export function settingsHooksKeptLocally(plan, event, group, opts) {
                 for (const h of gh) {
                     if (isRecord(h) && Object.hasOwn(h, 'plugin'))
                         continue;
-                    const k = settingsHookEntryKey(ownView(h));
-                    if (k !== undefined)
-                        sent.add(`${mk}\u0000${k}`);
+                    const v = ownView(h);
+                    const pair = isRecord(v) ? skipPairOf(v) : undefined;
+                    if (pair === undefined || !isRecord(v))
+                        continue;
+                    for (const k of Object.keys(v))
+                        wireKeys.add(k);
+                    const slot = `${mk}\u0000${pair.key}`;
+                    const list = sent.get(slot);
+                    if (list === undefined)
+                        sent.set(slot, [pair.env]);
+                    else
+                        appendOwnElement(list, pair.env);
                 }
             }
         }
@@ -832,8 +931,11 @@ export function settingsHooksKeptLocally(plan, event, group, opts) {
         const mk = skipMatcherKey(isRecord(group) ? group.matcher : undefined);
         let kept = null;
         hooks.forEach((h, i) => {
-            const k = settingsHookEntryKey(h);
-            const skip = k !== undefined && sent.has(`${mk}\u0000${k}`);
+            const view = localPairViewOf(event, h, wireKeys);
+            const pair = view === undefined ? undefined : skipPairOf(view);
+            const list = pair === undefined ? undefined : sent.get(`${mk}\u0000${pair.key}`);
+            const env = pair?.env;
+            const skip = list !== undefined && (env === undefined || list.some((w) => w !== undefined && w.every((n) => env.includes(n))));
             if (skip)
                 kept ??= hooks.slice(0, i);
             else if (kept !== null)
@@ -881,7 +983,7 @@ export function pluginHooksKeptLocally(plan, pluginId, event, groupIndex, hooks)
         return hooks;
     }
 }
-function settingsRowBaseOf(v) {
+function settingsRowBaseOf(v, engineEvent) {
     if (!isRecord(v))
         return undefined;
     const source = ownField(v, 'source');
@@ -890,7 +992,7 @@ function settingsRowBaseOf(v) {
     const hookIndex = ownField(v, 'hookIndex');
     if (typeof source !== 'string' || !Object.hasOwn(SOURCE_TEXT, source))
         return undefined;
-    if (typeof event !== 'string' || !ENGINE_EVENTS.has(event))
+    if (typeof event !== 'string' || !engineEvent(event))
         return undefined;
     if (!Number.isInteger(groupIndex) || groupIndex < 0 || !Number.isInteger(hookIndex) || hookIndex < 0)
         return undefined;
@@ -899,9 +1001,9 @@ function settingsRowBaseOf(v) {
 const DISPOSITION_SET = new Set(PLUGIN_HOOK_DISPOSITIONS);
 const REASON_SET = new Set(PLUGIN_HOOK_REASONS);
 const EXCLUSION_REASON_SET = new Set(PLUGIN_HOOK_EXCLUSION_REASONS);
-function settingsVerdictRowOf(v) {
+function settingsVerdictRowOf(v, engineEvent) {
     try {
-        const b = settingsRowBaseOf(v);
+        const b = settingsRowBaseOf(v, engineEvent);
         if (b === undefined)
             return undefined;
         const disposition = ownField(b.o, 'disposition');
@@ -914,9 +1016,9 @@ function settingsVerdictRowOf(v) {
         return undefined;
     }
 }
-function settingsExclusionRowOf(v) {
+function settingsExclusionRowOf(v, engineEvent) {
     try {
-        const b = settingsRowBaseOf(v);
+        const b = settingsRowBaseOf(v, engineEvent);
         if (b === undefined)
             return undefined;
         const reason = ownField(b.o, 'reason');
@@ -964,6 +1066,7 @@ const DROP_TEXT = {
     governance_unreadable: renderMessage(msg('config.hooks.plan.reason.closedGovernanceUnreadable')),
     policy_disable_all: renderMessage(msg('config.hooks.plan.reason.closedDisableAll')),
     no_executor: REASON_TEXT.no_executor,
+    layer_degraded: renderMessage(msg('config.hooks.plan.reason.layerDegraded')),
 };
 const SOURCE_TEXT = HOOK_SETTINGS_SOURCE_TEXT;
 export function pluginHookReasonText(reason) {
@@ -1045,6 +1148,7 @@ function namedPathsOfRow(d) {
         case 'governance_unreadable':
         case 'policy_disable_all':
         case 'no_executor':
+        case 'layer_degraded':
             return [];
     }
 }
@@ -1065,6 +1169,15 @@ function sourceNotAuthoredLine(source, row) {
     const coordinates = namedCoordinatesText(row.coordinates);
     return renderMessage(msg(row.coordinates.length === 1 ? 'config.hooks.plan.sourceNotAuthored.oneKey' : 'config.hooks.plan.sourceNotAuthored.manyKeys', { layer: SOURCE_TEXT[source], hooks, coordinates }));
 }
+function hookEntryFieldsUnreadableIn(plan) {
+    try {
+        const engine = isRecord(plan) ? readOwnDataValue(plan, 'engine') : undefined;
+        return isRecord(engine) && readOwnDataValue(engine, 'hookEntryFields') === 'unreadable';
+    }
+    catch {
+        return false;
+    }
+}
 export function hooksNotRunNotice(plan) {
     const lines = [];
     let closedBy;
@@ -1128,10 +1241,15 @@ export function hooksNotRunNotice(plan) {
     }
     for (const row of namedBySource.values())
         appendOwnElement(lines, row.reason === 'key_not_read' ? keyNotReadLine(row.source, row) : sourceNotAuthoredLine(row.source, row));
+    if (hookEntryFieldsUnreadableIn(plan) &&
+        (plan.settingsDropped.some((d) => d.notRun && d.reason === 'key_not_read') || plan.verdicts.some((v) => v.disposition === 'not_run' && v.reason === 'key_not_read'))) {
+        appendOwnElement(lines, renderMessage(msg('config.hooks.plan.keyNotRead.readerFieldsUnreadable')));
+    }
     const settingsVerdicts = plan.settingsVerdicts;
     const byVerdict = new Map();
+    const engineEvent = engineLaneOf(planSettingsContractOf(plan));
     for (const raw of Array.isArray(settingsVerdicts) ? settingsVerdicts : []) {
-        const v = settingsVerdictRowOf(raw);
+        const v = settingsVerdictRowOf(raw, engineEvent);
         if (v === undefined || v.disposition !== 'not_run')
             continue;
         const k = `${v.source}\u0000${v.reason}`;

package/dist/prepareRefusal.d.ts

@@ -1,8 +1,10 @@
 import { CONFIG_AGENT_UNKNOWN_TOOL, CONFIG_IMAGE_INVALID, CONFIG_LEGACY_TOOL_NAME, CONFIG_MCP_SERVER_NAME_COLLISION, CONFIG_TOOL_FACE_CONTROL, PROMPT_ASSEMBLED_ROLE_REFUSED, USER_ATTACHMENT_INVALID_ERROR_CODE, USER_INVOKED_SKILL_UNKNOWN_ERROR_CODE } from './engineErrorCodes.js';
+import type { AttachmentSupply } from './attachmentOutcome.js';
 export type PrepareRefusalCode = typeof CONFIG_LEGACY_TOOL_NAME | typeof CONFIG_IMAGE_INVALID | typeof CONFIG_AGENT_UNKNOWN_TOOL | typeof PROMPT_ASSEMBLED_ROLE_REFUSED | typeof USER_ATTACHMENT_INVALID_ERROR_CODE | typeof USER_INVOKED_SKILL_UNKNOWN_ERROR_CODE | typeof CONFIG_TOOL_FACE_CONTROL | typeof CONFIG_MCP_SERVER_NAME_COLLISION;
 export interface PrepareRefusalNoteFacts {
     readonly index?: number;
     readonly draftKept?: boolean;
+    readonly namedSupply?: AttachmentSupply;
 }
 export declare function prepareRefusalNoteOf(code: string | undefined, facts?: PrepareRefusalNoteFacts): string | undefined;
 export declare function prepareRefusalCodeOf(failure: {} | null | undefined): PrepareRefusalCode | undefined;

package/dist/prepareRefusal.js

@@ -6,6 +6,7 @@ import { effectiveWireErrorCode } from './wireErrorTriage.js';
 const nonNegInt = (v) => (typeof v === 'number' && Number.isSafeInteger(v) && v >= 0 ? v : undefined);
 const draftKeptSegment = (facts) => Object.hasOwn(facts, 'draftKept') && facts.draftKept === true ? ` · ${renderMessage(msg('notice.prepareRefusal.draftKept'))}` : '';
 const indexOf = (facts) => nonNegInt(Object.hasOwn(facts, 'index') ? facts.index : undefined);
+const pathNamed = (facts) => Object.hasOwn(facts, 'namedSupply') && facts.namedSupply === 'path';
 const PREPARE_REFUSAL_NOTES = Object.freeze({
     [CONFIG_LEGACY_TOOL_NAME]: () => `The engine refused this run at setup: a tool rule applied to it names a tool the engine refuses — ${REFUSED_NAME_CLASSES} (the engine's own error text names the entry). ` +
         'Every later run fails the same way until that entry is removed from wherever it is set: this session’s rule record, the settings sent with the run, a parent session’s rule record, or the deployment’s own tool rules.',
@@ -17,6 +18,8 @@ const PREPARE_REFUSAL_NOTES = Object.freeze({
         'Send only your own role text (the engine assembles the rest), then send it again',
     [USER_ATTACHMENT_INVALID_ERROR_CODE]: (facts) => {
         const index = indexOf(facts);
+        if (index !== undefined && pathNamed(facts))
+            return renderMessage(msg('notice.prepareRefusal.userAttachmentPath', { n: index + 1, draft: draftKeptSegment(facts) }));
         return index !== undefined
             ? `The engine refused attachment ${index + 1} of this message: it is in a form the engine does not accept, or larger than it takes${draftKeptSegment(facts)} · Remove or replace that attachment, then send it again`
             : 'The engine refused the files attached to this message: together with the message they are more than it can take in one request on this model, or one of them is in a form it does not accept' +
@@ -57,8 +60,15 @@ export function prepareRefusalNoteOf(code, facts) {
         catch {
             draftKept = undefined;
         }
+        let namedSupply;
+        try {
+            namedSupply = readOwnDataValue(bag, 'namedSupply');
+        }
+        catch {
+            namedSupply = undefined;
+        }
         const i = nonNegInt(index);
-        return PREPARE_REFUSAL_NOTES[code]({ ...(i !== undefined ? { index: i } : {}), ...(draftKept === true ? { draftKept: true } : {}) });
+        return PREPARE_REFUSAL_NOTES[code]({ ...(i !== undefined ? { index: i } : {}), ...(draftKept === true ? { draftKept: true } : {}), ...(namedSupply === 'path' ? { namedSupply: 'path' } : {}) });
     }
     catch {
         return undefined;

package/dist/request/taskRequest.js

@@ -1,4 +1,5 @@
 import { appendOwnElement, readOwnDataValue } from '../ownKey.js';
+import { planSettingsContractOf } from '../pluginHooksWire.js';
 import { refuseBadDisableSkills, refuseDisableSkillsConflict } from '../disableSkillsWire.js';
 import { ATTACHMENTS_SPEC_KEYS, AttachmentsSpecRefused } from '../attachmentsWireCaps.js';
 import { REASONING_EFFORT_WORDS, retiredAttachmentsKeyOf } from '../taskRequestWords.js';
@@ -558,7 +559,8 @@ export function refilterHostSettings(request, fresh, lane) {
             return unjudged();
         let names;
         try {
-            names = hookEnvNamesOf(finalHooks);
+            const plan = readOwnDataValue(host, 'hooks');
+            names = hookEnvNamesOf(finalHooks, planSettingsContractOf(typeof plan === 'object' && plan !== null ? plan : undefined));
         }
         catch {
             return unjudged();

package/dist/resultFrameKeys.d.ts

@@ -2,4 +2,5 @@ export declare function resultErrorCodeOf(frame: unknown): string | undefined;
 export declare function resultSelectedModelOf(frame: unknown): string | undefined;
 export declare function resultSalvagedResultOf(frame: unknown): string | undefined;
 export declare function resultParkFailedReasonOf(frame: unknown): string | undefined;
+export declare function resultTurnAbortedByOf(frame: object | null | undefined): string | undefined;
 export declare function resultErrorCodeInTextOf(frame: object | null | undefined): true | undefined;

package/dist/resultFrameKeys.js

@@ -11,6 +11,9 @@ export function resultSalvagedResultOf(frame) {
 export function resultParkFailedReasonOf(frame) {
     return readFrameStringKey(frame, '_sema_park_failed_reason');
 }
+export function resultTurnAbortedByOf(frame) {
+    return readFrameStringKey(frame, '_sema_turn_aborted_by');
+}
 export function resultErrorCodeInTextOf(frame) {
     if (!readFrameTrueMark(frame, '_sema_error_code_in_text'))
         return undefined;

package/dist/resumeRefusalCopy.js

@@ -2,7 +2,7 @@ import { msg, renderMessage } from './i18n/translate.js';
 import { readBlockedBy, readErrorNumber, readErrorString, readThrownSlot } from './wireFailureShape.js';
 import { guardedRead, ownDataField, readOwnDataNonEmptyString, readOwnDataValue } from './ownKey.js';
 import { CORE_RESUME_STARTUP_CAUSES } from './generated/engineFactTables.js';
-import { RESUME_CONTEXT_UNAVAILABLE, RESUME_PLACEMENT_MISMATCH, RESUME_PREFLIGHT_REJECTED, RESUME_PRINCIPAL_MISMATCH, RESUME_COMPOSITION_MISMATCH, RESUME_PARENT_CONSTRAINT_MISSING, RESUME_PARENT_CONSTRAINT_MISMATCH, RESUME_CONSTRAINT_UNPROJECTABLE, RESUME_POLICY_FOLD_CODE, PARKED_RESUME_STARTUP_FAILED, isStatusDerivedCoarseCode, RESUME_SESSION_NOT_FOUND, REQUEST_FIELD_CONFLICT, CHECKPOINT_UNSUPPORTED_VERSION, CHECKPOINT_WALLTIME_AXIS_RETIRED, CHECKPOINT_CONFIG_REFUSED, isRefusedParkCode, refusalSaysStillPending, refusalRetriableReading, } from './engineErrorCodes.js';
+import { RESUME_CONTEXT_UNAVAILABLE, RESUME_PLACEMENT_MISMATCH, RESUME_PREFLIGHT_REJECTED, RESUME_PRINCIPAL_MISMATCH, RESUME_COMPOSITION_MISMATCH, RESUME_PARENT_CONSTRAINT_MISSING, RESUME_PARENT_CONSTRAINT_MISMATCH, RESUME_CONSTRAINT_UNPROJECTABLE, RESUME_ISOLATION_SCOPE_MISMATCH, RESUME_AGENT_DEFINITION_MISMATCH, RESUME_POLICY_FOLD_CODE, PARKED_RESUME_STARTUP_FAILED, isStatusDerivedCoarseCode, RESUME_SESSION_NOT_FOUND, REQUEST_FIELD_CONFLICT, CHECKPOINT_UNSUPPORTED_VERSION, CHECKPOINT_WALLTIME_AXIS_RETIRED, CHECKPOINT_CONFIG_REFUSED, isRefusedParkCode, refusalSaysStillPending, refusalRetriableReading, } from './engineErrorCodes.js';
 import { capForDisplay } from './fleetTaskDesc.js';
 import { decisionRefusalWayOutContent } from './checkpointRowVerdict.js';
 import { engineVersionTier } from './supportFloor.js';
@@ -15,6 +15,8 @@ const REFUSAL_COPY_KEYS = Object.freeze({
     [RESUME_PARENT_CONSTRAINT_MISSING]: 'resume.refusal.parentConstraintMissing',
     [RESUME_PARENT_CONSTRAINT_MISMATCH]: 'resume.refusal.parentConstraintMismatch',
     [RESUME_CONSTRAINT_UNPROJECTABLE]: 'resume.refusal.constraintUnprojectable',
+    [RESUME_ISOLATION_SCOPE_MISMATCH]: 'resume.refusal.isolationScopeMismatch',
+    [RESUME_AGENT_DEFINITION_MISMATCH]: 'resume.refusal.agentDefinitionMismatch',
 });
 export const RESUME_REFUSAL_CODES = Object.freeze(Object.keys(REFUSAL_COPY_KEYS));
 export function resumeRefusalFromError(err) {