@sema-agent/client-core 0.82.0 → 0.82.2

package/dist/hitl/hitlBridge.d.ts

@@ -64,6 +64,29 @@ export declare class DecideTransportRetryExhaustedError extends Error {
     readonly attempts: number;
     constructor(attempts: number, lastFailureText: string);
 }
+export interface DecideOperationIdentity {
+    readonly operation: object;
+    readonly taskId: string;
+    readonly sessionId: string;
+    readonly boundCallId?: string;
+}
+export interface DecideOperationStart extends DecideOperationIdentity {
+    readonly phase: 'start';
+}
+export interface DecideOperationEnd extends DecideOperationIdentity {
+    readonly phase: 'end';
+    readonly ok: boolean;
+    readonly attempts: number;
+    readonly retryExhausted: boolean;
+}
+export type DecideOperationEvent = DecideOperationStart | DecideOperationEnd;
+export type DecideOperationObserver = (ev: DecideOperationEvent) => void | Promise<void>;
+export interface HitlBridgeOptions {
+    onDecideOperation?: DecideOperationObserver;
+}
+export interface DecideOperationSpan {
+    close(): void;
+}
 export interface ActiveGate {
     gate: CheckpointGate;
     seq?: string | undefined;
@@ -85,7 +108,8 @@ export declare class HitlBridge {
     private readonly client;
     private readonly taskId;
     private active;
-    constructor(client: HitlClientLike, taskId: string);
+    private readonly decideObserver;
+    constructor(client: HitlClientLike, taskId: string, opts?: HitlBridgeOptions);
     observe(ev: AgentEvent): void;
     currentGate(): CheckpointGate | null;
     currentGateReopen(): SuspendedReopenReading | null;
@@ -97,6 +121,7 @@ export declare class HitlBridge {
         remember?: 'session' | undefined;
     } | HitlDecideDenyOutcome, toolUseID?: string, opts?: {
         signal?: AbortSignal;
+        operation?: DecideOperationSpan;
     }, preResolvedPending?: PendingCheckpoint): Promise<unknown>;
     answerQuestion(answers: AskAnswer[], toolUseID?: string, opts?: {
         signal?: AbortSignal;
@@ -108,6 +133,9 @@ export declare class HitlBridge {
         signal?: AbortSignal;
     }): Promise<AssistantTaskStatus>;
     private decideRaw;
+    private decideIdentityOf;
+    openDecideOperation(): DecideOperationSpan;
+    private decideRawAttempts;
 }
 export type GatePrompt<D extends HitlPermissionDecisionLike = HitlPermissionDecisionLike> = (ctx: {
     toolName: string;

package/dist/hitl/hitlBridge.js

@@ -106,6 +106,94 @@ export class DecideTransportRetryExhaustedError extends Error {
         this.name = 'DecideTransportRetryExhaustedError';
     }
 }
+class DecideSpan {
+    owner;
+    observer;
+    identity;
+    attempts = 0;
+    ok = false;
+    retryExhausted = false;
+    closedFlag = false;
+    inFlight = 0;
+    ended = false;
+    constructor(owner, observer) {
+        this.owner = owner;
+        this.observer = observer;
+    }
+    admits(bridge, identity) {
+        if (bridge !== this.owner || this.closedFlag)
+            return false;
+        const mine = this.identity;
+        return mine === undefined || (mine.sessionId === identity.sessionId && mine.boundCallId === identity.boundCallId);
+    }
+    async run(identity, send) {
+        if (this.observer !== undefined && this.identity === undefined) {
+            this.identity = identity;
+            notifyDecideObserver(this.observer, Object.freeze({ ...this.identity, phase: 'start' }));
+        }
+        this.inFlight++;
+        const tally = { attempts: 0 };
+        try {
+            const r = await send(tally);
+            this.ok = true;
+            this.retryExhausted = false;
+            return r;
+        }
+        catch (e) {
+            this.ok = false;
+            this.retryExhausted = e instanceof DecideTransportRetryExhaustedError;
+            throw e;
+        }
+        finally {
+            this.attempts += tally.attempts;
+            this.inFlight--;
+            if (this.closedFlag && this.inFlight === 0)
+                this.emitEnd();
+        }
+    }
+    close() {
+        if (this.closedFlag)
+            return;
+        this.closedFlag = true;
+        if (this.inFlight === 0)
+            this.emitEnd();
+    }
+    emitEnd() {
+        if (this.ended)
+            return;
+        this.ended = true;
+        if (this.observer === undefined || this.identity === undefined)
+            return;
+        notifyDecideObserver(this.observer, Object.freeze({ ...this.identity, phase: 'end', ok: this.ok, attempts: this.attempts, retryExhausted: this.retryExhausted }));
+    }
+}
+function reportObserverFault(phase, what, e) {
+    try {
+        hostLog('debug', `hitlBridge: onDecideOperation(${phase}) ${what}: ${String(e).slice(0, 160)}`);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function wireOptsOf(opts) {
+    if (opts === undefined || opts.operation === undefined)
+        return opts;
+    return opts.signal !== undefined ? { signal: opts.signal } : undefined;
+}
+function notifyDecideObserver(observer, ev) {
+    try {
+        const out = observer(ev);
+        if (out && typeof out.then === 'function') {
+            void Promise.resolve(out).then(undefined, (e) => {
+                reportObserverFault(ev.phase, 'rejected', e);
+            });
+        }
+    }
+    catch (e) {
+        reportObserverFault(ev.phase, 'threw', e);
+    }
+}
 const ANY_TOOL_FAMILY = () => true;
 export async function findPendingForTask(client, taskId, matches, opts, callId, identityAccepts = (r) => matches(typeof r.toolName === 'string' ? r.toolName : undefined)) {
     let rows;
@@ -132,9 +220,11 @@ export class HitlBridge {
     client;
     taskId;
     active = null;
-    constructor(client, taskId) {
+    decideObserver;
+    constructor(client, taskId, opts) {
         this.client = client;
         this.taskId = taskId;
+        this.decideObserver = typeof opts?.onDecideOperation === 'function' ? opts.onDecideOperation : undefined;
     }
     observe(ev) {
         switch (ev.type) {
@@ -180,7 +270,7 @@ export class HitlBridge {
         return { boundCallId: p.boundCallId, boundInputHash: p.boundInputHash };
     }
     async decideTool(outcome, toolUseID, opts, preResolvedPending) {
-        const pending = preResolvedPending ?? (await this.pendingForDecide(toolUseID, opts));
+        const pending = preResolvedPending ?? (await this.pendingForDecide(toolUseID, wireOptsOf(opts)));
         if (!pending) {
             throw new HitlSafetyError('no pending checkpoint to decide (resolved/expired under the human) — refetch + re-present', 'no_pending');
         }
@@ -253,7 +343,48 @@ export class HitlBridge {
         }
         return this.client.assistant.resume(this.taskId, opts);
     }
-    async decideRaw(sessionId, decision, opts) {
+    async decideRaw(sessionId, decision, optsIn) {
+        const opts = wireOptsOf(optsIn);
+        const op = optsIn?.operation;
+        if (op instanceof DecideSpan) {
+            const identity = this.decideIdentityOf(sessionId, decision);
+            if (op.admits(this, identity))
+                return op.run(identity, (tally) => this.decideRawAttempts(sessionId, decision, opts, tally));
+        }
+        const observer = this.decideObserver;
+        const tally = { attempts: 0 };
+        if (observer === undefined)
+            return this.decideRawAttempts(sessionId, decision, opts, tally);
+        const identity = this.decideIdentityOf(sessionId, decision);
+        notifyDecideObserver(observer, Object.freeze({ ...identity, phase: 'start' }));
+        let ok = false;
+        let retryExhausted = false;
+        try {
+            const r = await this.decideRawAttempts(sessionId, decision, opts, tally);
+            ok = true;
+            return r;
+        }
+        catch (e) {
+            retryExhausted = e instanceof DecideTransportRetryExhaustedError;
+            throw e;
+        }
+        finally {
+            notifyDecideObserver(observer, Object.freeze({ ...identity, phase: 'end', ok, attempts: tally.attempts, retryExhausted }));
+        }
+    }
+    decideIdentityOf(sessionId, decision) {
+        const bound = decision.boundCallId;
+        return {
+            operation: Object.freeze({}),
+            taskId: this.taskId,
+            sessionId,
+            ...(typeof bound === 'string' && bound.length > 0 ? { boundCallId: bound } : {}),
+        };
+    }
+    openDecideOperation() {
+        return new DecideSpan(this, this.decideObserver);
+    }
+    async decideRawAttempts(sessionId, decision, opts, tally) {
         const callerAborted = () => opts?.signal?.aborted === true;
         const startedAt = Date.now();
         let attempts = 0;
@@ -261,6 +392,7 @@ export class HitlBridge {
         let backoff = DECIDE_TRANSPORT_RETRY_BACKOFF_MS;
         for (;;) {
             attempts++;
+            tally.attempts = attempts;
             try {
                 const r = await this.client.approvals.decide(sessionId, decision, opts);
                 return r;

package/dist/hitl/hitlHostSurface.js

@@ -1,7 +1,7 @@
 import { createSessionSlot, DEFAULT_SESSION_KEY } from '../sessionSlot.js';
 import { hostLog } from '../host.js';
 import { unrefTimer } from '../unrefTimer.js';
-import { corruptStoredRowContent, corruptStoredRowWhere } from '../wireErrorTriage.js';
+import { decideFailureNote } from '../decideFailureNote.js';
 import { HitlSafetyError } from './hitlBridge.js';
 const hostSurfaceByKey = createSessionSlot();
 const hostSurfaceMissesByKey = new Map();
@@ -113,8 +113,7 @@ export function observeCancelByDeny(settle, taskId) {
             hostLog('debug', `[hitl-cancel-deny] cancel-by-deny no_pending for run ${taskId} (benign — already resolved)`);
             return;
         }
-        const where = corruptStoredRowWhere(e);
-        const rowNote = where === undefined ? '' : ` — ${corruptStoredRowContent(where)}`;
+        const rowNote = decideFailureNote(e);
         hostLog('error', `[hitl-cancel-deny] cancel-by-deny FAILED for run ${taskId}: ${String(e)}${rowNote}`);
         surfaceCancelDenyWarn(`${CANCEL_DENY_WARN_TEXT}${rowNote}`);
     })

package/dist/hitl/parkResolver.d.ts

@@ -33,6 +33,7 @@ export type GateOutcome = {
     currentPending?: GateCurrentPending | undefined;
 };
 export declare function isAlreadyResolvedGateReason(reason: unknown): boolean;
+export declare function isGateStandingErrorCode(code: string | null | undefined): boolean;
 export declare function toAnsweredOutput(questions: unknown[], answer: QuestionAnswer): AskAnsweredOutput;
 export type ParkResolution = {
     kind: 'reattach';

package/dist/hitl/parkResolver.js

@@ -1,5 +1,6 @@
 import { putOwnKey } from '../ownKey.js';
 import { DecideTransportRetryExhaustedError, HitlBridge, HitlSafetyError, findPendingForTask, readDecideCurrentPending, readWireErrorCode, } from './hitlBridge.js';
+import { RESUME_POLICY_FOLD_CODE } from '../engineErrorCodes.js';
 import { publishQuestionFrame, registerLocalQuestionResponder, hasQuestionOverlay, } from '../liveQuestionStore.js';
 import { hostLog } from '../host.js';
 import { surfaceFsApprovalAndDecide } from './toolApprovalWire.js';
@@ -7,7 +8,7 @@ import { observeCancelByDeny } from './hitlHostSurface.js';
 import { flushHeldWithInterruptRewrite, isAskTool } from './frameRouter.js';
 import { approvalCallKey, askGateQuestionId } from './gateIdentity.js';
 import { readDecideReceipt } from '../decideReceipt.js';
-import { corruptStoredRowContent, corruptStoredRowWhere } from '../wireErrorTriage.js';
+import { decideFailureNote } from '../decideFailureNote.js';
 export const MAX_GATE_HOPS = 2;
 export function nextHopBudget(prev, round) {
     const total = (prev?.total ?? 0) + 1;
@@ -41,7 +42,14 @@ function alreadyResolvedReasonToken(reason) {
 }
 function isAlreadyResolvedFailure(outcome) {
     const code = 'code' in outcome && isGateFailureCode(outcome.code) ? outcome.code : undefined;
-    return code !== undefined ? code === 'no_pending' : isAlreadyResolvedGateReason(outcome.reason);
+    if (code !== undefined)
+        return code === 'no_pending';
+    if ('errorCode' in outcome && isGateStandingErrorCode(outcome.errorCode))
+        return false;
+    return isAlreadyResolvedGateReason(outcome.reason);
+}
+export function isGateStandingErrorCode(code) {
+    return code === RESUME_POLICY_FOLD_CODE || code === 'corrupt';
 }
 export function toAnsweredOutput(questions, answer) {
     const answers = {};
@@ -108,7 +116,7 @@ async function surfaceGateAndDecide(deps, taskId, askArgsByCall, signal, parkGat
         onPresented?.();
         publishQuestionFrame({ type: 'question', questionId, questions });
     });
-    const bridge = new HitlBridge(deps.client, taskId);
+    const bridge = new HitlBridge(deps.client, taskId, deps.onDecideOperation ? { onDecideOperation: deps.onDecideOperation } : undefined);
     if (answer === null) {
         observeCancelByDeny(bridge.decideTool({ decision: 'deny', reason: 'Interrupted by user' }, gatedCallId, undefined, pending), taskId);
         return { kind: 'aborted', gatedCallId };
@@ -141,7 +149,7 @@ async function surfaceGateAndDecide(deps, taskId, askArgsByCall, signal, parkGat
             kind: 'failed',
             stage: 'decide',
             gatedCallId,
-            reason: withCorruptStoredRow(`decide failed: ${String(e)}`, e),
+            reason: `decide failed: ${String(e)}${decideFailureNote(e)}`,
             ...(code !== undefined ? { code } : {}),
             ...(e instanceof DecideTransportRetryExhaustedError ? { retryExhausted: true } : {}),
             ...(currentPending !== undefined ? { currentPending } : {}),
@@ -149,10 +157,6 @@ async function surfaceGateAndDecide(deps, taskId, askArgsByCall, signal, parkGat
         };
     }
 }
-function withCorruptStoredRow(reason, err) {
-    const where = corruptStoredRowWhere(err);
-    return where === undefined ? reason : `${reason} — ${corruptStoredRowContent(where)}`;
-}
 function argsByCallOf(led) {
     return new Map(led.gatedStartArgs());
 }
@@ -166,7 +170,11 @@ function isFetchStepNoPending(outcome) {
 async function surfaceParkGate(park, ctx, gatedCallId, onPresented) {
     const { deps, led, taskId } = ctx;
     if (park.gate === 'fs') {
-        const outcome = await surfaceFsApprovalAndDecide({ client: deps.client, ...(onPresented ? { onPresented } : {}) }, taskId, argsByCallOf(led), ctx.signal, gatedCallId);
+        const outcome = await surfaceFsApprovalAndDecide({
+            client: deps.client,
+            ...(onPresented ? { onPresented } : {}),
+            ...(deps.onDecideOperation ? { onDecideOperation: deps.onDecideOperation } : {}),
+        }, taskId, argsByCallOf(led), ctx.signal, gatedCallId);
         const outcomeDenied = 'denied' in outcome ? outcome.denied : undefined;
         if (outcome.kind === 'decided' && outcomeDenied === true && outcome.gatedCallId) {
             const denySettledBy = 'denySettledBy' in outcome ? outcome.denySettledBy : undefined;

package/dist/hitl/planReviewWire.d.ts

@@ -29,6 +29,12 @@ export declare function armPlanReviewApproval(result: unknown, sessionKey?: stri
     submittedInPlanMode?: boolean;
 }): boolean;
 export type PlanReviewDecisionEffect = 'took_effect' | 'advanced' | 'still_parked' | 'not_sent' | 'not_applied' | 'unconfirmed';
+export interface PlanReviewOutcomeMeta {
+    taskId: string;
+    dispatchNo: number;
+    decision: 'approve' | 'reject';
+    effect: PlanReviewDecisionEffect;
+}
 export declare function planReviewOutcomeTail(taskId: string, decision: 'approve' | 'reject', effect: PlanReviewDecisionEffect): string;
 export declare function __resetPlanReviewDecisionLatchForTests(): void;
 export declare function decidePlanReview(taskId: string, decision: 'approve' | 'reject', permissionModeAfter?: string): Promise<void>;

package/dist/hitl/planReviewWire.js

@@ -4,6 +4,7 @@ import { makeEngineWireClient } from '../engineWireSdk.js';
 import { engineWireTarget } from '../engineWireTarget.js';
 import { enqueuePlanReviewOutcome } from '../notifications.js';
 import { corruptStoredRowContent, corruptStoredRowWhere } from '../wireErrorTriage.js';
+import { decideFailureNote } from '../decideFailureNote.js';
 import { isPlanReviewModeAfter } from './hitlBridge.js';
 import { engineCapString } from '../engineCapsCache.js';
 import { planReviewQuestionId, REOPEN_ID_TAIL } from './gateIdentity.js';
@@ -337,7 +338,7 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
                     const msg = e instanceof Error ? e.message : String(e);
                     hostLog('debug', `planReviewWire: ${decision} → ${status} ${msg.slice(0, 200)}`);
                     effect = status >= 400 && status < 500 ? 'not_applied' : 'unconfirmed';
-                    outcome = `The plan_review decision failed: HTTP ${status} ${msg}`.trim();
+                    outcome = `${`The plan_review decision failed: HTTP ${status} ${msg}`.trim()}${decideFailureNote(e)}`;
                 }
                 else {
                     outcome = `The plan_review decision could not reach the engine: ${String(e)}`;
@@ -346,7 +347,7 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
         }
     }
     try {
-        const delivered = enqueuePlanReviewOutcome(`<plan-review-outcome>\n${outcome}\n${planReviewOutcomeTail(taskId, decision, effect)}\n</plan-review-outcome>`);
+        const delivered = enqueuePlanReviewOutcome(`<plan-review-outcome>\n${outcome}\n${planReviewOutcomeTail(taskId, decision, effect)}\n</plan-review-outcome>`, { taskId, dispatchNo, decision, effect });
         if (!delivered) {
             hostLog('error', `planReviewWire: outcome enqueue MISSED (queue port not installed or lacks enqueueMetaPrompt) for task ${taskId} — model will not learn the ${decision} result`);
         }
@@ -382,6 +383,11 @@ export function reopenPlanReviewCard(taskId, opts) {
         if (typeof taskId !== 'string' || taskId.length === 0) {
             return receiptMs === undefined ? { reopened: false } : Promise.resolve({ reopened: false });
         }
+        if (decideInFlight.has(taskId)) {
+            hostLog('debug', `planReviewWire: reopen for task ${taskId} refused — a decision for this task is in flight (its answer is still being delivered)`);
+            const refused = { reopened: false, _sema_decisionInFlight: true };
+            return receiptMs === undefined ? refused : Promise.resolve(refused);
+        }
         const sessionKey = opts?.sessionKey ?? DEFAULT_SESSION_KEY;
         if (!hasQuestionOverlayFor(sessionKey)) {
             return receiptMs === undefined ? { reopened: false } : Promise.resolve({ reopened: false });

package/dist/hitl/toolApprovalWire.d.ts

@@ -1,4 +1,4 @@
-import { type GateCurrentPending, type HitlFailureStage, type HitlSafetyCode, type HitlClientLike } from './hitlBridge.js';
+import { type GateCurrentPending, type HitlFailureStage, type HitlSafetyCode, type HitlClientLike, type DecideOperationObserver } from './hitlBridge.js';
 import { type RuleStoreUnreadableKind } from '../gateVocabulary.js';
 import { type DenyAttributionRefusalDetail } from '../wireRefusalCopy.js';
 import { type DecideReceiptView } from '../decideReceipt.js';
@@ -43,6 +43,7 @@ export type FsApprovalOutcome = {
 export interface FsApprovalWireDeps {
     client: HitlClientLike;
     onPresented?: () => void;
+    onDecideOperation?: DecideOperationObserver;
 }
 export declare function structurallyEqual(a: unknown, b: unknown): boolean;
 export type RuleOfferMatch = SdkRuleOfferMatch;

package/dist/hitl/toolApprovalWire.js

@@ -7,7 +7,7 @@ import { observeCancelByDeny, surfaceRememberNotApplied, surfaceEditNotForwarded
 import { approvalCallKey, liveFrameCallKey } from './gateIdentity.js';
 import { isRuleStoreUnreadableKind } from '../gateVocabulary.js';
 import { denyAttributionRefusalFromError } from '../wireRefusalCopy.js';
-import { corruptStoredRowContent, corruptStoredRowWhere } from '../wireErrorTriage.js';
+import { decideFailureNote } from '../decideFailureNote.js';
 import { readDecideReceipt } from '../decideReceipt.js';
 import { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS, RULE_OFFERS_ABSENCE_REASONS, DENIAL_LIMIT_KINDS, } from '@sema-agent/sdk';
 export function isFsApprovalGate(gate) {
@@ -29,10 +29,6 @@ export function isToolApprovalGate(gate) {
         return true;
     return typeof gate?.toolName === 'string' && toolNameIsShellExec(gate.toolName);
 }
-function withCorruptStoredRow(reason, err) {
-    const where = corruptStoredRowWhere(err);
-    return where === undefined ? reason : `${reason} — ${corruptStoredRowContent(where)}`;
-}
 export function structurallyEqual(a, b) {
     if (a === b)
         return true;
@@ -137,7 +133,7 @@ export async function surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signa
     if (typeof args !== 'object' || args === null) {
         return { kind: 'failed', stage: 'input', gatedCallId, reason: 'gate has no tool input payload' };
     }
-    const bridge = new HitlBridge(deps.client, taskId);
+    const bridge = new HitlBridge(deps.client, taskId, deps.onDecideOperation ? { onDecideOperation: deps.onDecideOperation } : undefined);
     const callKey = approvalCallKey(gatedCallId, taskId);
     const ruleOffersReadOnly = readRuleOfferSupply(pending.ruleOffers, pending.ruleSuggestions);
     const durableProbeCause = pending.riskDescriptor?.probeCause;
@@ -167,110 +163,117 @@ export async function surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signa
             ? { toolCallId: pending.toolCallId }
             : {}),
     });
-    switch (card.kind) {
-        case 'failed':
-            return { kind: 'failed', stage: 'card', gatedCallId, reason: card.reason };
-        case 'retracted':
-            hostLog('debug', `liveHitlAskWire: approval card retracted without a decision for ${gatedCallId ?? '(no call)'} — nothing sent`);
-            return { kind: 'retracted', gatedCallId };
-        case 'aborted':
-            observeCancelByDeny(bridge.decideTool({ decision: 'deny', reason: 'Interrupted by user' }, gatedCallId, undefined, pending), taskId);
-            return { kind: 'aborted', gatedCallId };
-        case 'allow':
-            try {
-                if (card.allowSession) {
-                    try {
-                        const raw = await bridge.decideTool({ decision: 'approve', remember: 'session', ...(card.updatedInput !== undefined ? { updatedInput: card.updatedInput } : {}) }, gatedCallId, signal ? { signal } : undefined, pending);
-                        const receipt = readDecideReceipt(raw);
-                        return { kind: 'decided', gatedCallId, ...(receipt !== undefined ? { receipt } : {}) };
-                    }
-                    catch (e) {
-                        if (e instanceof HitlSafetyError || e instanceof DecideTransportRetryExhaustedError)
-                            throw e;
-                        if (readDecideCurrentPending(e) !== undefined)
-                            throw e;
-                        hostLog('debug', `liveToolApprovalWire: decide(approve+remember) failed (${String(e)}) — falling back to plain approve`);
+    const decideSpan = bridge.openDecideOperation();
+    const decideOpts = { ...(signal ? { signal } : {}), operation: decideSpan };
+    try {
+        switch (card.kind) {
+            case 'failed':
+                return { kind: 'failed', stage: 'card', gatedCallId, reason: card.reason };
+            case 'retracted':
+                hostLog('debug', `liveHitlAskWire: approval card retracted without a decision for ${gatedCallId ?? '(no call)'} — nothing sent`);
+                return { kind: 'retracted', gatedCallId };
+            case 'aborted':
+                observeCancelByDeny(bridge.decideTool({ decision: 'deny', reason: 'Interrupted by user' }, gatedCallId, undefined, pending), taskId);
+                return { kind: 'aborted', gatedCallId };
+            case 'allow':
+                try {
+                    if (card.allowSession) {
+                        try {
+                            const raw = await bridge.decideTool({ decision: 'approve', remember: 'session', ...(card.updatedInput !== undefined ? { updatedInput: card.updatedInput } : {}) }, gatedCallId, decideOpts, pending);
+                            const receipt = readDecideReceipt(raw);
+                            return { kind: 'decided', gatedCallId, ...(receipt !== undefined ? { receipt } : {}) };
+                        }
+                        catch (e) {
+                            if (e instanceof HitlSafetyError || e instanceof DecideTransportRetryExhaustedError)
+                                throw e;
+                            if (readDecideCurrentPending(e) !== undefined)
+                                throw e;
+                            hostLog('debug', `liveToolApprovalWire: decide(approve+remember) failed (${String(e)}) — falling back to plain approve`);
+                        }
                     }
+                    const raw = await bridge.decideTool({ decision: 'approve', ...(card.updatedInput !== undefined ? { updatedInput: card.updatedInput } : {}) }, gatedCallId, decideOpts, pending);
+                    const receipt = readDecideReceipt(raw);
+                    return { kind: 'decided', gatedCallId, ...(receipt !== undefined ? { receipt } : {}) };
                 }
-                const raw = await bridge.decideTool({ decision: 'approve', ...(card.updatedInput !== undefined ? { updatedInput: card.updatedInput } : {}) }, gatedCallId, signal ? { signal } : undefined, pending);
-                const receipt = readDecideReceipt(raw);
-                return { kind: 'decided', gatedCallId, ...(receipt !== undefined ? { receipt } : {}) };
-            }
-            catch (e) {
-                const currentPending = readDecideCurrentPending(e);
-                const wireCode = readWireErrorCode(e);
-                const safetyCode = e instanceof HitlSafetyError ? e.code : undefined;
-                return {
-                    kind: 'failed',
-                    stage: 'decide',
-                    gatedCallId,
-                    reason: withCorruptStoredRow(`decide(approve) failed: ${String(e)}`, e),
-                    ...(e instanceof DecideTransportRetryExhaustedError ? { retryExhausted: true } : {}),
-                    ...(currentPending !== undefined ? { currentPending } : {}),
-                    ...(wireCode !== undefined ? { errorCode: wireCode } : {}),
-                    ...(safetyCode !== undefined ? { safetyCode } : {}),
-                };
-            }
-        case 'deny': {
-            const denySettledByForWire = readApprovalDenySettledBy(card);
-            const denyReasonSnapshot = typeof card.reason === 'string' ? card.reason : undefined;
-            let lastSendCarriedAttribution = false;
-            try {
-                const denyBody = {
-                    decision: 'deny',
-                    reason: denyReasonForWire(denyReasonSnapshot, `task ${taskId}`) ?? DEFAULT_DENY_REASON,
-                    ...(denySettledByForWire === 'policy' ? { settledBy: 'policy' } : {}),
-                };
-                let attributionDropped = false;
-                let raw;
-                lastSendCarriedAttribution = denySettledByForWire === 'policy';
+                catch (e) {
+                    const currentPending = readDecideCurrentPending(e);
+                    const wireCode = readWireErrorCode(e);
+                    const safetyCode = e instanceof HitlSafetyError ? e.code : undefined;
+                    return {
+                        kind: 'failed',
+                        stage: 'decide',
+                        gatedCallId,
+                        reason: `decide(approve) failed: ${String(e)}${decideFailureNote(e)}`,
+                        ...(e instanceof DecideTransportRetryExhaustedError ? { retryExhausted: true } : {}),
+                        ...(currentPending !== undefined ? { currentPending } : {}),
+                        ...(wireCode !== undefined ? { errorCode: wireCode } : {}),
+                        ...(safetyCode !== undefined ? { safetyCode } : {}),
+                    };
+                }
+            case 'deny': {
+                const denySettledByForWire = readApprovalDenySettledBy(card);
+                const denyReasonSnapshot = typeof card.reason === 'string' ? card.reason : undefined;
+                let lastSendCarriedAttribution = false;
                 try {
-                    raw = await bridge.decideTool(denyBody, gatedCallId, signal ? { signal } : undefined, pending);
+                    const denyBody = {
+                        decision: 'deny',
+                        reason: denyReasonForWire(denyReasonSnapshot, `task ${taskId}`) ?? DEFAULT_DENY_REASON,
+                        ...(denySettledByForWire === 'policy' ? { settledBy: 'policy' } : {}),
+                    };
+                    let attributionDropped = false;
+                    let raw;
+                    lastSendCarriedAttribution = denySettledByForWire === 'policy';
+                    try {
+                        raw = await bridge.decideTool(denyBody, gatedCallId, decideOpts, pending);
+                    }
+                    catch (first) {
+                        if (!shouldResendWithoutAttribution(first, lastSendCarriedAttribution, signal))
+                            throw first;
+                        const { settledBy: _droppedKey, ...withoutAttribution } = denyBody;
+                        void _droppedKey;
+                        lastSendCarriedAttribution = false;
+                        hostLog('debug', `liveToolApprovalWire: decide(deny) for task ${taskId} was refused because the settlement note is not part of ` +
+                            'what this deployment signs — re-sending the SAME decision exactly once with that one key removed ' +
+                            '(the refusal happened before the approval was judged, so nothing was consumed and this is a re-delivery, not a second act)');
+                        raw = await bridge.decideTool(withoutAttribution, gatedCallId, decideOpts, pending);
+                        attributionDropped = true;
+                    }
+                    const receipt = readDecideReceipt(raw);
+                    const denySettledBy = denySettledByForWire;
+                    const denyReason = denyReasonSnapshot !== undefined && denyReasonSnapshot.trim() !== '' ? denyReasonSnapshot : undefined;
+                    return {
+                        kind: 'decided',
+                        gatedCallId,
+                        denied: true,
+                        ...(denySettledBy !== undefined ? { denySettledBy } : {}),
+                        ...(denyReason !== undefined ? { denyReason } : {}),
+                        ...(attributionDropped ? { denyAttributionDropped: true } : {}),
+                        ...(receipt !== undefined ? { receipt } : {}),
+                    };
                 }
-                catch (first) {
-                    if (!shouldResendWithoutAttribution(first, lastSendCarriedAttribution, signal))
-                        throw first;
-                    const { settledBy: _droppedKey, ...withoutAttribution } = denyBody;
-                    void _droppedKey;
-                    lastSendCarriedAttribution = false;
-                    hostLog('debug', `liveToolApprovalWire: decide(deny) for task ${taskId} was refused because the settlement note is not part of ` +
-                        'what this deployment signs — re-sending the SAME decision exactly once with that one key removed ' +
-                        '(the refusal happened before the approval was judged, so nothing was consumed and this is a re-delivery, not a second act)');
-                    raw = await bridge.decideTool(withoutAttribution, gatedCallId, signal ? { signal } : undefined, pending);
-                    attributionDropped = true;
+                catch (e) {
+                    const currentPending = readDecideCurrentPending(e);
+                    const wireCode = readWireErrorCode(e);
+                    const safetyCode = e instanceof HitlSafetyError ? e.code : undefined;
+                    const attributionRefusal = denyAttributionRefusalFromError(e, lastSendCarriedAttribution);
+                    return {
+                        kind: 'failed',
+                        stage: 'decide',
+                        gatedCallId,
+                        reason: `decide(deny) failed: ${String(e)}${decideFailureNote(e)}`,
+                        ...(e instanceof DecideTransportRetryExhaustedError ? { retryExhausted: true } : {}),
+                        ...(currentPending !== undefined ? { currentPending } : {}),
+                        ...(wireCode !== undefined ? { errorCode: wireCode } : {}),
+                        ...(safetyCode !== undefined ? { safetyCode } : {}),
+                        ...(attributionRefusal !== null ? { denyAttributionRefusal: attributionRefusal } : {}),
+                    };
                 }
-                const receipt = readDecideReceipt(raw);
-                const denySettledBy = denySettledByForWire;
-                const denyReason = denyReasonSnapshot !== undefined && denyReasonSnapshot.trim() !== '' ? denyReasonSnapshot : undefined;
-                return {
-                    kind: 'decided',
-                    gatedCallId,
-                    denied: true,
-                    ...(denySettledBy !== undefined ? { denySettledBy } : {}),
-                    ...(denyReason !== undefined ? { denyReason } : {}),
-                    ...(attributionDropped ? { denyAttributionDropped: true } : {}),
-                    ...(receipt !== undefined ? { receipt } : {}),
-                };
-            }
-            catch (e) {
-                const currentPending = readDecideCurrentPending(e);
-                const wireCode = readWireErrorCode(e);
-                const safetyCode = e instanceof HitlSafetyError ? e.code : undefined;
-                const attributionRefusal = denyAttributionRefusalFromError(e, lastSendCarriedAttribution);
-                return {
-                    kind: 'failed',
-                    stage: 'decide',
-                    gatedCallId,
-                    reason: withCorruptStoredRow(`decide(deny) failed: ${String(e)}`, e),
-                    ...(e instanceof DecideTransportRetryExhaustedError ? { retryExhausted: true } : {}),
-                    ...(currentPending !== undefined ? { currentPending } : {}),
-                    ...(wireCode !== undefined ? { errorCode: wireCode } : {}),
-                    ...(safetyCode !== undefined ? { safetyCode } : {}),
-                    ...(attributionRefusal !== null ? { denyAttributionRefusal: attributionRefusal } : {}),
-                };
             }
         }
     }
+    finally {
+        decideSpan.close();
+    }
 }
 function readReadRootCandidate(v) {
     if (typeof v !== 'object' || v === null)