@sema-agent/client-core 0.84.0 → 0.85.0

package/dist/hitl/sessionPolicyDeliverable.js

@@ -1,46 +1,8 @@
-const COVERING_NAMESPACE_PREFIXES = ['mcp__', 'a2a__'];
-const ENGINE_RETIRED_TOOL_NAMES = new Map([
-    ['read_file', 'Read'],
-    ['edit_file', 'Edit'],
-    ['write_file', 'Write'],
-    ['bash', 'Bash'],
-    ['bash_readonly', null],
-    ['glob', 'Glob'],
-    ['grep', 'Grep'],
-    ['web_fetch', 'WebFetch'],
-    ['tool_search', 'ToolSearch'],
-    ['skill', 'Skill'],
-    ['present_plan', 'ExitPlanMode'],
-    ['enter_plan_mode', 'EnterPlanMode'],
-    ['spawn_subagent', 'Agent'],
-    ['CronCancel', 'CronDelete'],
-    ['lsp', 'LSP'],
-    ['submit_output', 'StructuredOutput'],
-    ['repo_map', 'RepoMap'],
-    ['read_tool_result', 'ReadToolResult'],
-    ['report_blocked', 'ReportBlocked'],
-    ['declare_done', 'DeclareDone'],
-    ['run_workflow', 'Workflow'],
-    ['RunWorkflow', 'Workflow'],
-    ['Task', 'Agent'],
-    ['BashOutput', 'TaskOutput'],
-    ['AgentOutputTool', 'TaskOutput'],
-    ['BashOutputTool', 'TaskOutput'],
-    ['AgentOutput', 'TaskOutput'],
-    ['WorkflowStatus', null],
-    ['KillShell', 'TaskStop'],
-    ['KillBash', 'TaskStop'],
-    ['ListMcpResources', 'ListMcpResourcesTool'],
-    ['ReadMcpResource', 'ReadMcpResourceTool'],
-    ['ReadMcpResourceDir', 'ReadMcpResourceDirTool'],
-    ['MultiEdit', null],
-    ['Fork', null],
-    ['Sleep', null],
-    ['Remember', null],
-    ['remember', null],
-    ['Recall', null],
-    ['recall', null],
-]);
+import { CONFIG_LEGACY_TOOL_NAME } from '../engineErrorCodes.js';
+import { rosterMountedNames } from './rosterMountedNames.js';
+import { CORE_PROTOCOL_PREFIXES, CORE_RETIRED_TOOL_CURRENT_NAMES } from '../generated/toolNameTables.js';
+const COVERING_NAMESPACE_PREFIXES = CORE_PROTOCOL_PREFIXES;
+const ENGINE_RETIRED_TOOL_NAMES = CORE_RETIRED_TOOL_CURRENT_NAMES;
 const PREFIXES_IN_PROSE = COVERING_NAMESPACE_PREFIXES.map((prefix) => `"${prefix}"`).join(' or ');
 const WITHHELD_NOTICE = {
     ask_no_bucket: 'Not written to this session’s rule record: that record only holds rules that block outright, and this rule asks before running instead — recording it as a block would change what it means.',
@@ -49,6 +11,7 @@ const WITHHELD_NOTICE = {
     wildcard: 'Not written to this session’s rule record: this rule uses a wildcard (*), and an engine that matches that record by exact tool name would block none of the tools it covers.',
     not_a_tool_name: 'Not written to this session’s rule record: this entry is not exactly one tool name — it is empty, not text, or has spaces around the name.',
     legacy_tool_name: `Not written to this session’s rule record: unless a tool by exactly this name is available, the engine refuses it — it is a retired tool name, or it contains "__" but does not start with ${PREFIXES_IN_PROSE} — and with it in that record every later run of this session would fail at startup until that entry is removed from the record. If the tool still exists, use its current name; a server or agent-peer tool name starts with ${PREFIXES_IN_PROSE}.`,
+    not_in_roster: 'Not written to this session’s rule record: the tool roster supplied for this check has no tool by exactly this name, as a name or an alias, with letter case counted — it may be misspelled, or name a tool this deployment does not provide — so recorded as it is it would block nothing here.',
 };
 export const SESSION_POLICY_WITHHELD_WHY = Object.freeze(Object.keys(WITHHELD_NOTICE));
 const MAX_RULES = 10_000;
@@ -71,13 +34,32 @@ function withheldWhyOf(rule) {
     }
     if (rule.trim() !== rule)
         return 'not_a_tool_name';
-    if (ENGINE_RETIRED_TOOL_NAMES.has(rule))
-        return 'legacy_tool_name';
-    if (rule.includes('__') && !COVERING_NAMESPACE_PREFIXES.some((prefix) => rule.startsWith(prefix)))
+    if (isEngineRefusedToolName(rule))
         return 'legacy_tool_name';
     return undefined;
 }
-export function sessionPolicyDeliverable(behavior, rules) {
+export function isEngineRefusedToolName(name) {
+    if (typeof name !== 'string')
+        return false;
+    if (ENGINE_RETIRED_TOOL_NAMES.has(name))
+        return true;
+    return name.includes('__') && !COVERING_NAMESPACE_PREFIXES.some((prefix) => name.startsWith(prefix));
+}
+function suppliedRosterNames(opts) {
+    if (opts === undefined || opts === null)
+        return 'absent';
+    let roster;
+    try {
+        if (typeof opts !== 'object')
+            return 'unreadable';
+        roster = opts.roster;
+    }
+    catch {
+        return 'unreadable';
+    }
+    return rosterMountedNames(roster);
+}
+export function sessionPolicyDeliverable(behavior, rules, opts) {
     const entries = [];
     try {
         if (behavior !== 'deny' && behavior !== 'ask')
@@ -99,6 +81,10 @@ export function sessionPolicyDeliverable(behavior, rules) {
     catch {
         return unreadable();
     }
+    const known = suppliedRosterNames(opts);
+    if (known === 'unreadable')
+        return unreadable();
+    const mounted = known === 'absent' ? undefined : known;
     const withheld = [];
     if (behavior === 'ask') {
         for (const r of entries)
@@ -111,7 +97,7 @@ export function sessionPolicyDeliverable(behavior, rules) {
             withheld.push({ rule: '', why: 'not_a_tool_name' });
             continue;
         }
-        const why = withheldWhyOf(r);
+        const why = withheldWhyOf(r) ?? (mounted !== undefined && !mounted.has(r) ? 'not_in_roster' : undefined);
         if (why === undefined)
             exact.push(r);
         else {
@@ -128,3 +114,8 @@ export function sessionPolicyWithheldNotice(why) {
         ? WITHHELD_NOTICE[why]
         : 'Not written to this session’s rule record.';
 }
+const LEGACY_TOOL_NAME_FAILURE_NOTE = `This run did not start: a tool rule applied to it names a tool the engine refuses — a retired tool name, or a name that contains "__" but does not start with ${PREFIXES_IN_PROSE} (the engine's own error text names the entry). ` +
+    'Every later run fails the same way until that entry is removed from wherever it is set: this session’s rule record, the settings sent with the run, a parent session’s rule record, or the deployment’s own tool rules.';
+export function legacyToolNameFailureNoteOf(code) {
+    return code === CONFIG_LEGACY_TOOL_NAME ? LEGACY_TOOL_NAME_FAILURE_NOTE : undefined;
+}

package/dist/hitl/sessionPolicyWire.d.ts

@@ -1,5 +1,6 @@
 import type { SessionPermissionRules, StoredSessionRules } from '@sema-agent/sdk';
 import type { SessionPolicyReading } from '../sessionPolicyCapability.js';
+import type { ToolRosterView } from '../toolRoster.js';
 export interface SessionPolicyFacade {
     getPolicy(sessionId: string, opts?: {
         signal?: AbortSignal;
@@ -93,3 +94,42 @@ export declare function tightenSessionPolicy(facade: SessionPolicyFacade, req: S
     signal?: AbortSignal;
 }): Promise<SessionPolicyTightenOutcome>;
 export declare function sessionPolicyTightenNotice(outcome: SessionPolicyTightenOutcome): string;
+export interface SessionPolicyRemovedEntry {
+    readonly field: 'toolDeny' | 'toolAllow';
+    readonly rule: string;
+}
+export type SessionPolicyRemovalOutcome = {
+    kind: 'roster_required';
+    why: SessionPolicyRosterRequiredWhy;
+} | {
+    kind: 'removed';
+    rev: number;
+    removed: readonly SessionPolicyRemovedEntry[];
+} | {
+    kind: 'nothing_to_remove';
+    rev: number;
+} | {
+    kind: 'loosen_forbidden';
+    message: string;
+    refused: readonly SessionPolicyRemovedEntry[];
+} | {
+    kind: 'conflict';
+    rev: number;
+} | {
+    kind: 'read_failed';
+    why: Extract<SessionPolicyTightenUnknownWhy, 'face_unavailable' | 'session_not_found' | 'session_ownerless' | 'unauthorized' | 'request_rejected' | 'store_corrupt' | 'read_unreadable' | 'read_failed'>;
+    message?: string;
+} | {
+    kind: 'write_refused';
+    why: Extract<SessionPolicyTightenUnknownWhy, 'face_unavailable' | 'session_not_found' | 'session_ownerless' | 'unauthorized' | 'request_rejected' | 'store_corrupt' | 'write_refused'>;
+    message?: string;
+} | {
+    kind: 'write_unconfirmed';
+    why: Extract<SessionPolicyTightenUnknownWhy, 'write_indeterminate' | 'write_receipt_unreadable' | 'write_receipt_mismatch'>;
+    message?: string;
+};
+export type SessionPolicyRosterRequiredWhy = 'absent' | 'unreadable';
+export declare function removeRefusedSessionRules(facade: SessionPolicyFacade, sessionId: string, roster: ToolRosterView | undefined, opts?: {
+    signal?: AbortSignal;
+}): Promise<SessionPolicyRemovalOutcome>;
+export declare function sessionPolicyRemovalNotice(outcome: SessionPolicyRemovalOutcome): string;

package/dist/hitl/sessionPolicyWire.js

@@ -1,5 +1,7 @@
 import { wireFailureShapeOf } from '../wireFailureShape.js';
 import { hostLog } from '../host.js';
+import { isEngineRefusedToolName } from './sessionPolicyDeliverable.js';
+import { rosterMountedNames } from './rosterMountedNames.js';
 const RULE_FIELD_PRESENCE = {
     toolAllow: true,
     toolDeny: true,
@@ -306,3 +308,174 @@ export function sessionPolicyTightenNotice(outcome) {
             }
     }
 }
+function withoutRefusedEntries(prior, mounted) {
+    const REFUSABLE_NAME_FIELDS = ['toolDeny', 'toolAllow'];
+    const isRefusable = (f) => REFUSABLE_NAME_FIELDS.includes(f);
+    const next = {};
+    const removed = [];
+    for (const field of SESSION_POLICY_RULE_FIELDS) {
+        const list = Object.hasOwn(prior, field) ? prior[field] : undefined;
+        if (list === undefined)
+            continue;
+        if (!isRefusable(field)) {
+            next[field] = [...list];
+            continue;
+        }
+        const kept = [];
+        const seen = new Set();
+        for (const x of list) {
+            if (!isEngineRefusedToolName(x) || mounted.has(x)) {
+                kept.push(x);
+                continue;
+            }
+            if (seen.has(x))
+                continue;
+            seen.add(x);
+            removed.push({ field, rule: x });
+        }
+        next[field] = kept;
+    }
+    return { next, removed };
+}
+function removalFailed(failure, leg) {
+    const u = unknownFrom(failure, leg);
+    const message = u.message;
+    switch (u.why) {
+        case 'write_indeterminate':
+            return { kind: 'write_unconfirmed', why: 'write_indeterminate', ...(message !== undefined ? { message } : {}) };
+        case 'read_failed':
+        case 'read_unreadable':
+            return { kind: 'read_failed', why: u.why, ...(message !== undefined ? { message } : {}) };
+        case 'write_refused':
+            return { kind: 'write_refused', why: 'write_refused', ...(message !== undefined ? { message } : {}) };
+        case 'face_unavailable':
+        case 'session_not_found':
+        case 'session_ownerless':
+        case 'unauthorized':
+        case 'request_rejected':
+        case 'store_corrupt':
+            return leg === 'read'
+                ? { kind: 'read_failed', why: u.why, ...(message !== undefined ? { message } : {}) }
+                : { kind: 'write_refused', why: u.why, ...(message !== undefined ? { message } : {}) };
+        default:
+            return leg === 'read'
+                ? { kind: 'read_failed', why: 'read_failed', ...(message !== undefined ? { message } : {}) }
+                : { kind: 'write_unconfirmed', why: 'write_indeterminate', ...(message !== undefined ? { message } : {}) };
+    }
+}
+async function attemptRemoval(facade, sessionId, mounted, opts) {
+    const read = await readSessionPolicy(facade, sessionId, opts);
+    if (read.kind === 'failed')
+        return { done: removalFailed(read.failure, 'read') };
+    if (read.kind === 'malformed')
+        return { done: { kind: 'read_failed', why: 'read_unreadable', message: read.detail } };
+    const { next, removed } = withoutRefusedEntries(read.rules, mounted);
+    if (removed.length === 0)
+        return { done: { kind: 'nothing_to_remove', rev: read.rev } };
+    let receipt;
+    try {
+        receipt = await facade.putPolicy(sessionId, { rules: next, expectedRev: read.rev }, opts);
+    }
+    catch (e) {
+        const failure = classifySessionPolicyFailure(e);
+        if (failure.kind === 'loosen-forbidden')
+            return { done: { kind: 'loosen_forbidden', message: failure.message, refused: removed } };
+        if (failure.kind === 'cas-conflict')
+            return { retryAtRev: read.rev };
+        return { done: removalFailed(failure, 'write') };
+    }
+    let narrowed;
+    try {
+        narrowed = narrowStoredRecord(receipt);
+    }
+    catch {
+        narrowed = { ok: false, why: 'envelope', detail: 'policy write receipt could not be read' };
+    }
+    if (!narrowed.ok)
+        return { done: { kind: 'write_unconfirmed', why: 'write_receipt_unreadable', message: narrowed.detail } };
+    const mismatch = receiptMismatch(next, narrowed.rules, read.rev, narrowed.rev) ??
+        (removed.some((e) => {
+            const r = Object.hasOwn(narrowed.rules, e.field) ? narrowed.rules[e.field] : undefined;
+            return r !== undefined && r.includes(e.rule);
+        })
+            ? 'the write receipt still holds an entry that was sent for removal'
+            : null);
+    if (mismatch !== null)
+        return { done: { kind: 'write_unconfirmed', why: 'write_receipt_mismatch', message: mismatch } };
+    return { done: { kind: 'removed', rev: narrowed.rev, removed } };
+}
+export async function removeRefusedSessionRules(facade, sessionId, roster, opts) {
+    const mounted = rosterMountedNames(roster);
+    if (typeof mounted === 'string')
+        return { kind: 'roster_required', why: mounted };
+    const first = await attemptRemoval(facade, sessionId, mounted, opts);
+    if ('done' in first)
+        return first.done;
+    hostLog('debug', 'sessionPolicyWire: the session rule record moved between this read and this removal — re-reading once and judging the other writer’s record again');
+    const second = await attemptRemoval(facade, sessionId, mounted, opts);
+    if ('done' in second)
+        return second.done;
+    return { kind: 'conflict', rev: second.retryAtRev };
+}
+export function sessionPolicyRemovalNotice(outcome) {
+    const generic = 'The session’s rule record may not have changed — re-read it before doing anything else.';
+    if (outcome === null || typeof outcome !== 'object')
+        return generic;
+    switch (outcome.kind) {
+        case 'roster_required':
+            return outcome.why === 'unreadable'
+                ? 'The tool roster supplied for this removal could not be read, so nothing was changed: without it an entry that looks refused may name a tool this deployment mounts itself, and removing it would lift a restriction that is in effect. Supply the tool roster exactly as read from a run’s assembly manifest and try again.'
+                : 'No tool roster was supplied for this removal, so nothing was changed: without it an entry that looks refused may name a tool this deployment mounts itself, and removing it would lift a restriction that is in effect. Supply the tool roster from a run of this session on this deployment (a run that fails at startup reports none) and try again.';
+        case 'removed': {
+            const list = Array.isArray(outcome.removed) ? outcome.removed : [];
+            const n = list.length;
+            const what = n === 1 ? '1 entry' : `${n} entries`;
+            const fields = new Set(list.map((e) => (typeof e === 'object' && e !== null ? e.field : undefined)));
+            const deny = fields.has('toolDeny')
+                ? ' Removing names from the deny list lifts no block on any tool mounted for this session’s runs; to block such a tool under its current name, add a new deny rule with that name.'
+                : '';
+            const allow = fields.has('toolAllow')
+                ? ' Removing names from the allow list allows nothing new: the tools those names were meant to allow stay outside it, and an allow list left empty allows no tool at all; to allow such a tool under its current name, add its current name to the allow list.'
+                : '';
+            return `Removed ${what} from this session’s rule record (now at version ${outcome.rev}): ${n === 1 ? 'it names' : 'each names'} a tool the engine refuses, and no tool in the supplied roster answers to ${n === 1 ? 'it' : 'those names'}; this record no longer stops the session’s runs from starting.${deny}${allow}`;
+        }
+        case 'nothing_to_remove':
+            return 'This session’s rule record holds no entry naming a tool the engine refuses that the supplied roster does not mount, so nothing was changed. If runs still fail at startup over a refused tool name, that entry is set somewhere this record does not cover — the settings sent with the run, a parent session’s rule record, or the deployment’s own tool rules — or it is a name the engine refuses that this version does not yet recognise, or the failing run does not mount a tool the supplied roster has under that name.';
+        case 'loosen_forbidden':
+            return 'The engine refused to take these entries out of this session’s rule record: on this engine only an operator can remove entries from it, so the record is unchanged. Ask an operator to remove them, or continue in a new session.';
+        case 'conflict':
+            return 'This session’s rule record was changed by someone else while the refused entries were being removed, twice in a row — nothing was changed. Try again once the other change has finished.';
+        case 'read_failed':
+            switch (outcome.why) {
+                case 'face_unavailable':
+                    return 'This deployment does not keep per-session tool rules, so there is no session rule record to remove entries from — nothing was changed.';
+                case 'session_not_found':
+                    return 'This session is not readable from here — it may not exist, or it may belong to someone else; nothing was changed.';
+                case 'session_ownerless':
+                    return 'This session has no owner, so it has no session rule record to change; nothing was changed.';
+                case 'unauthorized':
+                    return 'This call could not present a verifiable identity, so nothing was changed.';
+                case 'store_corrupt':
+                    return 'The engine could not establish which version this session’s rules are at, so nothing was changed. This needs an operator to look at the rule store.';
+                case 'read_unreadable':
+                    return 'The session’s current rules could not be read, so nothing was changed — rewriting a record that cannot be read could replace real restrictions.';
+                default:
+                    return 'The session’s current rules could not be fetched, so nothing was changed.';
+            }
+        case 'write_refused':
+            switch (outcome.why) {
+                case 'store_corrupt':
+                    return 'The engine could not establish which version this session’s rules are at and refused to stamp a new one, so nothing was changed. This needs an operator to look at the rule store.';
+                case 'session_not_found':
+                    return 'This session is not writable from here — it may not exist, or it may belong to someone else; nothing was changed.';
+                case 'unauthorized':
+                    return 'This call could not present a verifiable identity, so nothing was changed.';
+                default:
+                    return 'The engine refused this change, so nothing was changed. Re-read the session’s rules before trying again.';
+            }
+        case 'write_unconfirmed':
+            return 'The removal was sent but no clear answer came back from the engine — it may already be in effect. Run the removal again: it re-reads the record, and reports nothing left to remove if it did take effect.';
+        default:
+            return generic;
+    }
+}

package/dist/hitl/toolApprovalWire.d.ts

@@ -4,7 +4,7 @@ import { type ApprovalMandateWord } from '../gateVocabulary.js';
 import type { ToolPermissionRequest } from '../seatContract.js';
 import { type DenyAttributionRefusalDetail } from '../wireRefusalCopy.js';
 import { type DecideReceiptView } from '../decideReceipt.js';
-import { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS, RULE_OFFERS_ABSENCE_REASONS, DENIAL_LIMIT_KINDS } from '@sema-agent/sdk';
+import { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS, RULE_OFFERS_ABSENCE_REASONS } from '@sema-agent/sdk';
 import type { RuleSuggestion, ToolApprovalRespondAck, PersistedRuleAnchor as SdkPersistedRuleAnchor, RuleOfferMatch as SdkRuleOfferMatch, RuleOfferBatchMember as SdkRuleOfferBatchMember, RuleOfferUncoveredDetail as SdkRuleOfferUncoveredDetail, RuleOfferUncoveredReason as SdkRuleOfferUncoveredReason, AskOrigin as SdkAskOrigin, RuleOffersAbsence as SdkRuleOffersAbsence, DenialLimitKind as SdkDenialLimitKind, DenialLimitFallback as SdkDenialLimitFallback } from '@sema-agent/sdk';
 export declare function isFsApprovalGate(gate: {
     kind?: unknown;
@@ -58,7 +58,9 @@ export type AskOrigin = SdkAskOrigin;
 export type RuleOffersAbsence = SdkRuleOffersAbsence;
 export type DenialLimitKind = SdkDenialLimitKind;
 export type DenialLimitFallback = SdkDenialLimitFallback;
-export { RULE_OFFERS_ABSENCE_REASONS, DENIAL_LIMIT_KINDS };
+export { RULE_OFFERS_ABSENCE_REASONS };
+export declare const ASK_ORIGIN_WORDS: readonly string[];
+export declare const APPROVAL_MANDATE_WORDS: readonly ["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "write_protection_unresolved"];
 export type WireRuleOffer = {
     kind: 'single';
     rule: string;

package/dist/hitl/toolApprovalWire.js

@@ -11,7 +11,7 @@ import { isApprovalMandateWord } from '../gateVocabulary.js';
 import { denyAttributionRefusalFromError } from '../wireRefusalCopy.js';
 import { decideFailureNote } from '../decideFailureNote.js';
 import { readDecideReceipt } from '../decideReceipt.js';
-import { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS, RULE_OFFERS_ABSENCE_REASONS, DENIAL_LIMIT_KINDS, } from '@sema-agent/sdk';
+import { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS, RULE_OFFERS_ABSENCE_REASONS, ASK_ORIGINS, PERSISTED_RULE_MANDATES, } from '@sema-agent/sdk';
 export function isFsApprovalGate(gate) {
     if (!gate)
         return false;
@@ -52,7 +52,9 @@ export function structurallyEqual(a, b) {
     return ka.every(k => structurallyEqual(a[k], b[k]));
 }
 export { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS };
-export { RULE_OFFERS_ABSENCE_REASONS, DENIAL_LIMIT_KINDS };
+export { RULE_OFFERS_ABSENCE_REASONS };
+export const ASK_ORIGIN_WORDS = ASK_ORIGINS;
+export const APPROVAL_MANDATE_WORDS = PERSISTED_RULE_MANDATES;
 export const APPROVAL_DENY_SETTLED_BY_WORDS = Object.freeze(['human', 'policy']);
 export function readApprovalDenySettledBy(decision) {
     if (decision === null || typeof decision !== 'object')
@@ -282,7 +284,7 @@ export async function surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signa
                         kind: 'failed',
                         stage: 'decide',
                         gatedCallId,
-                        reason: `decide(approve) failed: ${String(e)}${decideFailureNote(e)}`,
+                        reason: `decide(approve) failed: ${String(e)}${decideFailureNote(e, 'approve')}`,
                         ...(e instanceof DecideTransportRetryExhaustedError ? { retryExhausted: true } : {}),
                         ...(currentPending !== undefined ? { currentPending } : {}),
                         ...(wireCode !== undefined ? { errorCode: wireCode } : {}),
@@ -339,7 +341,7 @@ export async function surfaceFsApprovalAndDecide(deps, taskId, argsByCall, signa
                         kind: 'failed',
                         stage: 'decide',
                         gatedCallId,
-                        reason: `decide(deny) failed: ${String(e)}${decideFailureNote(e)}`,
+                        reason: `decide(deny) failed: ${String(e)}${decideFailureNote(e, 'deny')}`,
                         ...(e instanceof DecideTransportRetryExhaustedError ? { retryExhausted: true } : {}),
                         ...(currentPending !== undefined ? { currentPending } : {}),
                         ...(wireCode !== undefined ? { errorCode: wireCode } : {}),

package/dist/index.d.ts

@@ -22,7 +22,8 @@ export { _resetLiveQuestionStore, hasLocalQuestionResponder, hasQuestionOverlay,
 export type { AskQuestion, AskQuestionOption, QuestionAnswer, QuestionFrame, } from './liveQuestionStore.js';
 export * from './engineInlineTaskStats.js';
 export * from './printToolResultFrame.js';
-export * from './engineCapsCache.js';
+export { __resetEngineCapsCacheForTests, engineCapState, engineCapString, engineCapsGeneration, engineCapsSettled, engineCapTrue, engineCapValue, invalidateEngineCaps, kickEngineCapsProbe, } from './engineCapsCache.js';
+export type { EngineCapState, EngineCapValueState, } from './engineCapsCache.js';
 export * from './sqlEngineCapability.js';
 export * from './writeProtectionCapability.js';
 export * from './webSearchBackendCapability.js';
@@ -70,7 +71,8 @@ export * from './sseIdleTriage.js';
 export * from './engineWireSdk.js';
 export * from './classifierVerdictWire.js';
 export { stripSystemReminderBlocks, unwrapSystemReminder } from './systemReminderTag.js';
-export { ACTIVE_RUN_BUSY_ERROR_CODE, asModelFallbackReason, CAPABILITY_SELF_ORCHESTRATION_REQUIRED, CONFIG_DELEGATION_ENTRY_CAPS, CONFIG_LIMIT_INVALID, CONFIG_LIMIT_UNKNOWN_KEY, CONFIG_MEMORY_PROJECT_KEY_SPELLING, CONFIG_MEMORY_WRITE_SCOPE_MISMATCH, CONFIG_REFUSAL_CODES, CONFIG_STRATEGY_FIND_LIMIT_INVALID, CONFIG_STRATEGY_MAX_SIZE_INVALID, DECIDE_WORKFLOW_HOST_UNKNOWN, DECIDE_WORKFLOW_LANE_CODES, DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED, DELEGATION_CAP_CODES, DELEGATION_CONCURRENCY_CAP, DELEGATION_SESSION_CAP, delegationCapDispositionOf, DRAINING_ERROR_CODE, ENGINE_STOP_REASONS, engineStopReasonToCc, ENV_LIFETIME_EXPIRED, GATE_PARKED_ERROR_CODE, isConfigRefusalCode, isDelegationCapCode, isInterruptedToolEndCode, isLimitsExceededCode, isRewindFamilyCode, isWorkflowParkRefusalCode, LIMITS_MAX_COST_EXCEEDED, LIMITS_MAX_TOKENS_EXCEEDED, LIMITS_MAX_TURNS_EXCEEDED, LIMITS_MAX_WALLTIME_EXCEEDED, MCP_SERVER_REVOKED, MODEL_FALLBACK_INHERIT_NO_TIER_BINDING, OUTPUT_INVALID, RESUME_AT_ERROR_CODE_PREFIX, RESUME_CONTEXT_UNAVAILABLE, RESUME_ENV_FAILED, RESUME_PLACEMENT_MISMATCH, RESUME_POLICY_FOLD_CODE, RESUME_PREFLIGHT_REJECTED, RESUME_REOPEN_CODES, RESUME_RETRY_LATER_CODES, RESUME_TOOL_CONTRACT_MISMATCH, RESUME_TOOL_UNAVAILABLE, RESUME_USAGE_WINDOW_EXHAUSTED, REWIND_ERROR_CODE_PREFIXES, SCENARIO_NOT_ALLOWED_ERROR_CODE, STOP_CONFLICT_CODES, STREAM_MAX_DURATION, TOOL_END_INTERRUPTED_NEVER_STARTED, TOOL_END_INTERRUPTED_OUTCOME_UNKNOWN, USAGE_WINDOW_EXHAUSTED, WORKFLOW_PARK_REFUSAL_CODES, } from './engineErrorCodes.js';
+export { findSystemReminderOpenTag, type SystemReminderOpenTagSpan } from './systemReminderTag.js';
+export { ACTIVE_RUN_BUSY_ERROR_CODE, asModelFallbackReason, CAPABILITY_SELF_ORCHESTRATION_REQUIRED, CONFIG_DELEGATION_ENTRY_CAPS, CONFIG_LEGACY_TOOL_NAME, CONFIG_LIMIT_INVALID, CONFIG_LIMIT_UNKNOWN_KEY, CONFIG_MEMORY_PROJECT_KEY_SPELLING, CONFIG_MEMORY_WRITE_SCOPE_MISMATCH, CONFIG_REFUSAL_CODES, CONFIG_STRATEGY_FIND_LIMIT_INVALID, CONFIG_STRATEGY_MAX_SIZE_INVALID, CORRUPT_SESSION_ERROR_CODE, DECIDE_CLAIM_LOST, DECIDE_GATE_MOVED, DECIDE_NOT_PARKED, DECIDE_PARK_MOVED_CODES, DECIDE_WORKFLOW_HOST_UNKNOWN, DECIDE_WORKFLOW_LANE_CODES, DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED, DELEGATION_CAP_CODES, DELEGATION_CONCURRENCY_CAP, DELEGATION_SESSION_CAP, delegationCapDispositionOf, DRAINING_ERROR_CODE, ENGINE_STOP_REASONS, engineStopReasonToCc, ENV_LIFETIME_EXPIRED, GATE_PARKED_ERROR_CODE, isConfigRefusalCode, isCorruptSessionCode, isDecideParkMovedCode, isDelegationCapCode, isInterruptedToolEndCode, isLimitsExceededCode, isRewindFamilyCode, isStatusDerivedCoarseCode, isWorkflowParkRefusalCode, LIMITS_MAX_COST_EXCEEDED, LIMITS_MAX_TOKENS_EXCEEDED, LIMITS_MAX_TURNS_EXCEEDED, LIMITS_MAX_WALLTIME_EXCEEDED, MCP_SERVER_REVOKED, MODEL_FALLBACK_INHERIT_NO_TIER_BINDING, OUTPUT_INVALID, PARKED_RESUME_STARTUP_FAILED, RESUME_AT_ERROR_CODE_PREFIX, RESUME_CONTEXT_UNAVAILABLE, RESUME_ENV_FAILED, RESUME_PLACEMENT_MISMATCH, RESUME_POLICY_FOLD_CODE, RESUME_PREFLIGHT_REJECTED, RESUME_REOPEN_CODES, RESUME_RETRY_LATER_CODES, RESUME_TOOL_CONTRACT_MISMATCH, RESUME_TOOL_UNAVAILABLE, RESUME_USAGE_WINDOW_EXHAUSTED, REWIND_ERROR_CODE_PREFIXES, SCENARIO_NOT_ALLOWED_ERROR_CODE, STATUS_DERIVED_COARSE_CODES, STOP_CONFLICT_CODES, STREAM_MAX_DURATION, TOOL_END_INTERRUPTED_NEVER_STARTED, TOOL_END_INTERRUPTED_OUTCOME_UNKNOWN, USAGE_WINDOW_EXHAUSTED, WORKFLOW_PARK_REFUSAL_CODES, } from './engineErrorCodes.js';
 export type { DelegationCapDisposition, ModelFallbackReason, } from './engineErrorCodes.js';
 export * from './agentsWireCaps.js';
 export * from './attachmentsWireCaps.js';
@@ -87,6 +89,7 @@ export * from './oneShotWireCaps.js';
 export * from './rewindWireCaps.js';
 export * from './rewindArchiveCapability.js';
 export * from './fileHistoryCaptureCapability.js';
+export * from './sealedKeyCapability.js';
 export * from './registryQuotaUsage.js';
 export * from './selfOrchestrationWireCaps.js';
 export * from './skillsWireCaps.js';
@@ -128,7 +131,7 @@ export * from './subagent/engineRowStopGate.js';
 export * from './subagent/engineSubagentOutput.js';
 export * from './subagent/engineSubagentSteer.js';
 export { __resetRetainWithoutWakeWarningForTests, auditRetainWithoutWake, classifySubagentResumeFailure, resolveOwnerRunId, resolveSubagentContinueTarget, resolveSubagentResumeContext, resumeSettledSubagent, SUBAGENT_RESUME_CAP, subagentResumeAvailable, } from './subagent/engineSubagentResume.js';
-export type { RetainWithoutWakeInput, RetainWithoutWakeVerdict, SubagentOwnerContext, SubagentResumeContext, SubagentResumeFacade, SubagentResumeFailureKind, SubagentResumeFailureVerdict, SubagentResumeOutcome, } from './subagent/engineSubagentResume.js';
+export type { RetainWithoutWakeInput, RetainWithoutWakeVerdict, SubagentOwnerContext, SubagentResumeContext, SubagentResumeFacade, SubagentResumeFailureKind, SubagentResumeFailureVerdict, SubagentResumeOutcome, SubagentResumeWire, SubagentResumeWireClient, } from './subagent/engineSubagentResume.js';
 export * from './subagent/engineTaskHandleWire.js';
 export * from './subagent/engineCompactWire.js';
 export * from './subagent/engineSubagentTail.js';
@@ -138,6 +141,8 @@ export { engineWireTarget, engineWireTargetFor, installEngineWireTarget, install
 export type { EngineWireTarget, } from './engineWireTarget.js';
 export * from './principalWire.js';
 export * from './wireErrorTriage.js';
+export * from './corruptSession.js';
+export * from './corruptSessionCopy.js';
 export * from './resumeRefusalCopy.js';
 export * from './wireRefusalCopy.js';
 export * from './decideReceipt.js';
@@ -186,6 +191,8 @@ export * from './agentSession/contract.js';
 export * from './agentSession/backgroundView.js';
 export { readEngineAgentRegistry, isEngineAgentRegistryListingSuperseded } from './agentSession/engineAgentRegistryRead.js';
 export type { EngineAgentRegistryClient } from './agentSession/engineAgentRegistryRead.js';
+export { stopEngineSessionBackground, engineSessionBackgroundReceiptReadingOf, ENGINE_SESSION_BACKGROUND_RECEIPT_STATES, } from './agentSession/engineSessionBackgroundStop.js';
+export type { EngineSessionBackgroundStopClient, EngineSessionBackgroundStopWire, EngineSessionBackgroundStopOptions, EngineSessionBackgroundReceipt, EngineSessionBackgroundStopUnavailableWhy, EngineSessionBackgroundStopRefusedWhy, EngineSessionBackgroundStopResult, EngineSessionBackgroundReceiptState, EngineSessionBackgroundReceiptReading, } from './agentSession/engineSessionBackgroundStop.js';
 export * from './model/catalog.js';
 export * from './model/catalogLoader.js';
 export * from './model/providerAuth.js';

package/dist/index.js

@@ -18,7 +18,7 @@ export * from './fleetAgentPanelProjection.js';
 export { _resetLiveQuestionStore, hasLocalQuestionResponder, hasQuestionOverlay, hasQuestionOverlayFor, onQuestionFrame, onQuestionFrameFor, publishQuestionFrame, publishQuestionFrameFor, registerLocalQuestionResponder, respondToQuestion, setQuestionRespond, } from './liveQuestionStore.js';
 export * from './engineInlineTaskStats.js';
 export * from './printToolResultFrame.js';
-export * from './engineCapsCache.js';
+export { __resetEngineCapsCacheForTests, engineCapState, engineCapString, engineCapsGeneration, engineCapsSettled, engineCapTrue, engineCapValue, invalidateEngineCaps, kickEngineCapsProbe, } from './engineCapsCache.js';
 export * from './sqlEngineCapability.js';
 export * from './writeProtectionCapability.js';
 export * from './webSearchBackendCapability.js';
@@ -64,7 +64,8 @@ export * from './sseIdleTriage.js';
 export * from './engineWireSdk.js';
 export * from './classifierVerdictWire.js';
 export { stripSystemReminderBlocks, unwrapSystemReminder } from './systemReminderTag.js';
-export { ACTIVE_RUN_BUSY_ERROR_CODE, asModelFallbackReason, CAPABILITY_SELF_ORCHESTRATION_REQUIRED, CONFIG_DELEGATION_ENTRY_CAPS, CONFIG_LIMIT_INVALID, CONFIG_LIMIT_UNKNOWN_KEY, CONFIG_MEMORY_PROJECT_KEY_SPELLING, CONFIG_MEMORY_WRITE_SCOPE_MISMATCH, CONFIG_REFUSAL_CODES, CONFIG_STRATEGY_FIND_LIMIT_INVALID, CONFIG_STRATEGY_MAX_SIZE_INVALID, DECIDE_WORKFLOW_HOST_UNKNOWN, DECIDE_WORKFLOW_LANE_CODES, DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED, DELEGATION_CAP_CODES, DELEGATION_CONCURRENCY_CAP, DELEGATION_SESSION_CAP, delegationCapDispositionOf, DRAINING_ERROR_CODE, ENGINE_STOP_REASONS, engineStopReasonToCc, ENV_LIFETIME_EXPIRED, GATE_PARKED_ERROR_CODE, isConfigRefusalCode, isDelegationCapCode, isInterruptedToolEndCode, isLimitsExceededCode, isRewindFamilyCode, isWorkflowParkRefusalCode, LIMITS_MAX_COST_EXCEEDED, LIMITS_MAX_TOKENS_EXCEEDED, LIMITS_MAX_TURNS_EXCEEDED, LIMITS_MAX_WALLTIME_EXCEEDED, MCP_SERVER_REVOKED, MODEL_FALLBACK_INHERIT_NO_TIER_BINDING, OUTPUT_INVALID, RESUME_AT_ERROR_CODE_PREFIX, RESUME_CONTEXT_UNAVAILABLE, RESUME_ENV_FAILED, RESUME_PLACEMENT_MISMATCH, RESUME_POLICY_FOLD_CODE, RESUME_PREFLIGHT_REJECTED, RESUME_REOPEN_CODES, RESUME_RETRY_LATER_CODES, RESUME_TOOL_CONTRACT_MISMATCH, RESUME_TOOL_UNAVAILABLE, RESUME_USAGE_WINDOW_EXHAUSTED, REWIND_ERROR_CODE_PREFIXES, SCENARIO_NOT_ALLOWED_ERROR_CODE, STOP_CONFLICT_CODES, STREAM_MAX_DURATION, TOOL_END_INTERRUPTED_NEVER_STARTED, TOOL_END_INTERRUPTED_OUTCOME_UNKNOWN, USAGE_WINDOW_EXHAUSTED, WORKFLOW_PARK_REFUSAL_CODES, } from './engineErrorCodes.js';
+export { findSystemReminderOpenTag } from './systemReminderTag.js';
+export { ACTIVE_RUN_BUSY_ERROR_CODE, asModelFallbackReason, CAPABILITY_SELF_ORCHESTRATION_REQUIRED, CONFIG_DELEGATION_ENTRY_CAPS, CONFIG_LEGACY_TOOL_NAME, CONFIG_LIMIT_INVALID, CONFIG_LIMIT_UNKNOWN_KEY, CONFIG_MEMORY_PROJECT_KEY_SPELLING, CONFIG_MEMORY_WRITE_SCOPE_MISMATCH, CONFIG_REFUSAL_CODES, CONFIG_STRATEGY_FIND_LIMIT_INVALID, CONFIG_STRATEGY_MAX_SIZE_INVALID, CORRUPT_SESSION_ERROR_CODE, DECIDE_CLAIM_LOST, DECIDE_GATE_MOVED, DECIDE_NOT_PARKED, DECIDE_PARK_MOVED_CODES, DECIDE_WORKFLOW_HOST_UNKNOWN, DECIDE_WORKFLOW_LANE_CODES, DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED, DELEGATION_CAP_CODES, DELEGATION_CONCURRENCY_CAP, DELEGATION_SESSION_CAP, delegationCapDispositionOf, DRAINING_ERROR_CODE, ENGINE_STOP_REASONS, engineStopReasonToCc, ENV_LIFETIME_EXPIRED, GATE_PARKED_ERROR_CODE, isConfigRefusalCode, isCorruptSessionCode, isDecideParkMovedCode, isDelegationCapCode, isInterruptedToolEndCode, isLimitsExceededCode, isRewindFamilyCode, isStatusDerivedCoarseCode, isWorkflowParkRefusalCode, LIMITS_MAX_COST_EXCEEDED, LIMITS_MAX_TOKENS_EXCEEDED, LIMITS_MAX_TURNS_EXCEEDED, LIMITS_MAX_WALLTIME_EXCEEDED, MCP_SERVER_REVOKED, MODEL_FALLBACK_INHERIT_NO_TIER_BINDING, OUTPUT_INVALID, PARKED_RESUME_STARTUP_FAILED, RESUME_AT_ERROR_CODE_PREFIX, RESUME_CONTEXT_UNAVAILABLE, RESUME_ENV_FAILED, RESUME_PLACEMENT_MISMATCH, RESUME_POLICY_FOLD_CODE, RESUME_PREFLIGHT_REJECTED, RESUME_REOPEN_CODES, RESUME_RETRY_LATER_CODES, RESUME_TOOL_CONTRACT_MISMATCH, RESUME_TOOL_UNAVAILABLE, RESUME_USAGE_WINDOW_EXHAUSTED, REWIND_ERROR_CODE_PREFIXES, SCENARIO_NOT_ALLOWED_ERROR_CODE, STATUS_DERIVED_COARSE_CODES, STOP_CONFLICT_CODES, STREAM_MAX_DURATION, TOOL_END_INTERRUPTED_NEVER_STARTED, TOOL_END_INTERRUPTED_OUTCOME_UNKNOWN, USAGE_WINDOW_EXHAUSTED, WORKFLOW_PARK_REFUSAL_CODES, } from './engineErrorCodes.js';
 export * from './agentsWireCaps.js';
 export * from './attachmentsWireCaps.js';
 export * from './clientContextWireCaps.js';
@@ -80,6 +81,7 @@ export * from './oneShotWireCaps.js';
 export * from './rewindWireCaps.js';
 export * from './rewindArchiveCapability.js';
 export * from './fileHistoryCaptureCapability.js';
+export * from './sealedKeyCapability.js';
 export * from './registryQuotaUsage.js';
 export * from './selfOrchestrationWireCaps.js';
 export * from './skillsWireCaps.js';
@@ -127,6 +129,8 @@ export * from './engineSessionParam.js';
 export { engineWireTarget, engineWireTargetFor, installEngineWireTarget, installEngineWireTargetFor, } from './engineWireTarget.js';
 export * from './principalWire.js';
 export * from './wireErrorTriage.js';
+export * from './corruptSession.js';
+export * from './corruptSessionCopy.js';
 export * from './resumeRefusalCopy.js';
 export * from './wireRefusalCopy.js';
 export * from './decideReceipt.js';
@@ -172,6 +176,7 @@ export * from './seatContract.js';
 export * from './agentSession/contract.js';
 export * from './agentSession/backgroundView.js';
 export { readEngineAgentRegistry, isEngineAgentRegistryListingSuperseded } from './agentSession/engineAgentRegistryRead.js';
+export { stopEngineSessionBackground, engineSessionBackgroundReceiptReadingOf, ENGINE_SESSION_BACKGROUND_RECEIPT_STATES, } from './agentSession/engineSessionBackgroundStop.js';
 export * from './model/catalog.js';
 export * from './model/catalogLoader.js';
 export * from './model/providerAuth.js';

package/dist/liveInitToolFace.js

@@ -1,4 +1,5 @@
 import { makeEngineWireClient, resolveWireAuth } from './engineWireSdk.js';
+import { settleWithinDeadline } from './abortableSleep.js';
 import { hostLog } from './host.js';
 import { scenarioForPrint } from './scenarioWire.js';
 import { resolveHeadlessInteractiveTools } from './interactiveToolsWire.js';
@@ -58,17 +59,34 @@ export function _resetLiveInitToolFaceForTest() {
     cached = null;
 }
 export async function probeScenarioTools(baseUrl, scenario, opts) {
-    const client = makeEngineWireClient({
-        baseUrl,
-        ...(opts?.authToken ? { token: opts.authToken } : {}),
-        ...(opts?.principal ? { principal: opts.principal } : {}),
-        timeoutMs: opts?.timeoutMs ?? 2000,
-        ...(opts?.fetchImpl ? { fetchImpl: opts.fetchImpl } : {}),
-    });
-    if (!client)
-        return null;
+    const injected = opts?.client;
+    let body;
+    if (injected !== undefined) {
+        if (typeof injected?.scenarioCapabilities !== 'function')
+            return null;
+        const got = await settleWithinDeadline(opts?.timeoutMs ?? 2000, (signal) => injected.scenarioCapabilities(scenario, { signal }));
+        if (got.kind !== 'value')
+            return null;
+        body = got.value;
+    }
+    else {
+        const client = makeEngineWireClient({
+            baseUrl,
+            ...(opts?.authToken ? { token: opts.authToken } : {}),
+            ...(opts?.principal ? { principal: opts.principal } : {}),
+            timeoutMs: opts?.timeoutMs ?? 2000,
+            ...(opts?.fetchImpl ? { fetchImpl: opts.fetchImpl } : {}),
+        });
+        if (!client)
+            return null;
+        try {
+            body = await client.scenarioCapabilities(scenario);
+        }
+        catch {
+            return null;
+        }
+    }
     try {
-        const body = await client.scenarioCapabilities(scenario);
         if (!Array.isArray(body?.tools))
             return null;
         const names = body.tools.filter((t) => typeof t === 'string' && t.length > 0);

package/dist/permissionWireCaps.d.ts

@@ -1,4 +1,5 @@
-export type PermissionMode = 'default' | 'plan' | 'acceptEdits' | 'bypassPermissions' | 'auto';
+import { type TaskRequestPermissionMode } from './taskRequestWords.js';
+export type PermissionMode = TaskRequestPermissionMode;
 export interface PermissionModeField {
     permissionMode?: PermissionMode;
 }

package/dist/permissionWireCaps.js

@@ -1,10 +1,5 @@
-const KNOWN = new Set([
-    'default',
-    'plan',
-    'acceptEdits',
-    'bypassPermissions',
-    'auto',
-]);
+import { PERMISSION_MODE_WORDS } from './taskRequestWords.js';
+const KNOWN = new Set(PERMISSION_MODE_WORDS);
 export function permissionModeField(mode, opts) {
     if (typeof mode === 'string' && mode !== 'default' && KNOWN.has(mode)) {
         return { permissionMode: mode };

package/dist/request/taskRequest.d.ts

@@ -49,6 +49,7 @@ export interface TaskRequestInput {
     memoryCapture?: 'off';
     memory?: 'off';
     approverPosture?: NonNullable<TaskRequest['approverPosture']>;
+    fileHistory?: 'disabled';
     rewind?: Record<string, unknown>;
     repo?: string;
     council?: boolean;
@@ -102,6 +103,7 @@ export declare const APPROVER_POSTURE_BYPASS: "bypass";
 export declare function approverPostureDeclarationField(declared: boolean): {
     approverPosture: 'bypass';
 } | Record<string, never>;
+export declare const FILE_HISTORY_DISABLED: "disabled";
 export declare function memoryOffDeclared(input: {
     flag?: unknown;
     settingsMemory?: unknown;