@sema-agent/client-core 0.85.2 → 0.87.0

package/dist/adapt/arms.js

@@ -10,11 +10,19 @@ import { registerSubagentAlias, registerSubagentContentAlias } from '../subagent
 import { readAsyncLaunchedAgentReceipt } from '../toolResult.js';
 import { isWorkflowAgentTaskId, recordWorkflowAgentTaskId } from '../workflow.js';
 import { isTerminalStatus } from '../runTerminal.js';
+import { readToolHistoryMismatchKey } from '../toolHistoryMismatch.js';
 import { resolveEnginePanelTaskId } from '../engineAgentPanelStore.js';
 import { fleetRowAgentType } from '../fleet/fleetRowAgentType.js';
 import { chrome, mainLane, transcript, messageIdentityOf } from './ids.js';
 import { wiringManifestViewOf } from '../adapter/downstream/wiringManifestView.js';
 import { CANCEL_MESSAGE, decisionOf, flattenWireOutput, REJECT_MESSAGE, sanitizeToolUseBlock, shortTaskLabel, TASK_TOOL_NAMES, WORKFLOW_TOOL_NAMES, } from './wireShapes.js';
+function toolHistoryKeyCarry(m) {
+    if (m._sema_api_error_message !== true)
+        return {};
+    const raw = m._sema_tool_history_mismatch;
+    const key = readToolHistoryMismatchKey(typeof raw === 'object' && raw !== null ? raw : undefined);
+    return key === undefined ? {} : { _sema_tool_history_mismatch: key };
+}
 const assistantArm = function* (m, { ctx, idOf, text, cards, inst }) {
     const message = m.message;
     const blocks = Array.isArray(message?.content)
@@ -120,6 +128,7 @@ const assistantArm = function* (m, { ctx, idOf, text, cards, inst }) {
             session_id: ctx.sessionId,
             parent_tool_use_id: null,
             ...(m._sema_api_error_message === true ? { _sema_api_error_message: true } : {}),
+            ...toolHistoryKeyCarry(m),
         }, ctx.now());
         text.markEmittedText(textBlock.text);
     }
@@ -685,6 +694,9 @@ function prefixOf(whole, part) {
         return trimmed;
     return null;
 }
+const ERROR_SUBTYPE_PREFIX = 'error_';
+const _errorSubtypePrefixPin = true;
+void _errorSubtypePrefixPin;
 const resultArm = function* (m, { ctx, idOf, text, cards, panel, flags }) {
     yield chrome({ kind: 'retry_status', laneProof: mainLane(), status: null });
     yield* panel.settle(null, false);
@@ -698,7 +710,8 @@ const resultArm = function* (m, { ctx, idOf, text, cards, panel, flags }) {
     });
     yield* text.takeAnswerSegment();
     const salvaged = m._sema_salvaged_result;
-    const terminalText = typeof salvaged === 'string' ? salvaged : typeof m.result === 'string' ? m.result : '';
+    const errorEnvelope = typeof m.subtype === 'string' && m.subtype.startsWith(ERROR_SUBTYPE_PREFIX);
+    const terminalText = typeof salvaged === 'string' ? salvaged : !errorEnvelope && typeof m.result === 'string' ? m.result : '';
     const committed = text.lastCommittedAnswerText;
     const terminalIdentity = messageIdentityOf(m, ctx);
     const emitTerminal = function* (body, tag) {

package/dist/adapter/downstream/terminalToSdkResult.d.ts

@@ -1,5 +1,5 @@
-import type { AgentEvent, DeniedBy, TaskStats } from '@sema-agent/sdk';
-import { type CcToolDenialKind } from '../../gateVocabulary.js';
+import type { AgentEvent, TaskStats } from '@sema-agent/sdk';
+import { type CcToolDenialKind, type GateDeniedByWord } from '../../gateVocabulary.js';
 import { type SDKMessage, type EmitContext } from '../types.js';
 import type { TerminalReason } from '@sema-agent/agent-types';
 import { type SemaModelUsage } from './turnUsageToModelUsage.js';
@@ -32,7 +32,7 @@ export interface SemaPermissionDenial {
     readonly _sema_tool_input_source?: 'tool_start';
     readonly _sema_tool_input_redacted?: true;
     readonly _sema_tool_arg?: string;
-    readonly deniedBy?: DeniedBy;
+    readonly deniedBy?: GateDeniedByWord;
     readonly _sema_denied_by_source?: 'tool_end';
     readonly toolDenialKind?: CcToolDenialKind;
 }

package/dist/adapter/downstream/terminalToSdkResult.js

@@ -499,6 +499,7 @@ function errorResult(ctx, parts) {
         ...selectedModelParts(parts.model),
         ...(parts.salvagedResult !== undefined ? { _sema_salvaged_result: parts.salvagedResult } : {}),
         ...(parts.outcomeUnknown === true ? { _sema_outcome: 'unknown' } : {}),
+        ...(parts.parkFailedReason !== undefined ? { _sema_park_failed_reason: washCredentials(parts.parkFailedReason) } : {}),
     });
 }
 export function doneToSdkResult(ev, ctx, observed) {
@@ -513,7 +514,9 @@ export function doneToSdkResult(ev, ctx, observed) {
     const durationMs = elapsedMs(ctx);
     const errorCode = runTerminalCode(terminal);
     const degraded = degradedOf(r);
-    const errorBase = { durationMs, stats, model: r.model, errorCode, degraded, observed, facts: effectiveFactParts(rec) };
+    const parkFailedRaw = ev._sema_park_failed_reason;
+    const parkFailedReason = typeof parkFailedRaw === 'string' && parkFailedRaw.length > 0 ? parkFailedRaw : undefined;
+    const errorBase = { durationMs, stats, model: r.model, errorCode, degraded, observed, facts: effectiveFactParts(rec), parkFailedReason };
     if (terminal?.kind === 'failed') {
         const failedCode = terminal.code;
         const failedMessage = terminal.message;

package/dist/adapter/runStream.js

@@ -5,9 +5,11 @@ import { readRunCostFacts, terminalToSdkResult, TOOL_INPUT_JOIN_MAX_CALLS } from
 import { coerceOutput, publishSubagentContentEvent } from '../subagentContentStore.js';
 import { ACTIVE_RUN_BUSY_ERROR_CODE, OUTPUT_INVALID, isCorruptSessionCode, isLimitsExceededCode } from '../engineErrorCodes.js';
 import { corruptSessionContent } from '../corruptSessionCopy.js';
+import { classifyToolHistoryMismatch, noteToolHistoryTerminal, openToolHistoryGeneration, TOOL_HISTORY_REWIND_SENTENCE, toolHistoryMismatchRowKey, toolHistoryRepeatSentence, toolHistoryRewindOffered, } from '../toolHistoryMismatch.js';
 import { isReviewPark, readRunTerminal, runTerminalCode } from '../runTerminal.js';
 import { washCredentials } from '../displayUntrusted.js';
 import { ccToolDenialKindForToolEnd, gateDeniedBy, gateOutcomeOf } from '../gateOutcome.js';
+import { resumeReopenContent, resumeReopenFromError, suspendedReopenOf } from '../hitl/suspendedReopen.js';
 import { isCcToolDenialKind, isCcToolDenialKindADenial, isGateDeniedByWord } from '../gateVocabulary.js';
 const mainLane = () => ({ lane: 'main' });
 function emitChromeFireAndForget(ctx, event) {
@@ -19,6 +21,27 @@ function emitChromeFireAndForget(ctx, event) {
     }
     catch { }
 }
+function suspendedReopenedNotice(ev) {
+    try {
+        const reopen = suspendedReopenOf(ev);
+        if (reopen.kind !== 'reopened')
+            return undefined;
+        const detail = resumeReopenFromError({ errorCode: reopen.code, retriable: true });
+        const rawTaskId = ev.taskId;
+        const eventId = eventSeq(ev);
+        return {
+            kind: 'suspended_reopened',
+            laneProof: mainLane(),
+            reopen,
+            ...(detail !== null ? { content: resumeReopenContent(detail) } : {}),
+            ...(typeof eventId === 'string' && eventId.length > 0 ? { eventId } : {}),
+            ...(typeof rawTaskId === 'string' && rawTaskId.length > 0 ? { taskId: rawTaskId } : {}),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
 export function pendingGateIsProvablyDifferent(prev, next) {
     const a = prev?.checkpointId;
     const b = next?.checkpointId;
@@ -98,7 +121,7 @@ export function isModelOutputErrorRowText(text) {
     return text.trimStart().startsWith(`${MODEL_OUTPUT_ERROR_PREFIX}:`);
 }
 export const OUTCOME_UNKNOWN_ROW_PREFIX = 'Outcome unknown';
-function syntheticTerminalRow(ctx, text) {
+function syntheticTerminalRow(ctx, text, historyKey) {
     return stamp(ctx, {
         uuid: undefined,
         session_id: undefined,
@@ -106,8 +129,22 @@ function syntheticTerminalRow(ctx, text) {
         message: { role: 'assistant', model: '<synthetic>', content: [{ type: 'text', text: washCredentials(text) }] },
         parent_tool_use_id: null,
         _sema_api_error_message: true,
+        ...(historyKey !== undefined ? { _sema_tool_history_mismatch: historyKey } : {}),
     });
 }
+function engineRunIdOf(result) {
+    const v = result?.runId;
+    return typeof v === 'string' && v.length > 0 ? v : undefined;
+}
+function engineSessionIdOf(result) {
+    const v = result?.sessionId;
+    return typeof v === 'string' && v.length > 0 ? v : undefined;
+}
+function providerFailureStatusOf(result) {
+    const af = result?.apiFailure;
+    const status = typeof af === 'object' && af !== null ? af.status : undefined;
+    return typeof status === 'number' && Number.isFinite(status) ? status : undefined;
+}
 export function isOutcomeUnknownRowText(text) {
     return text.trimStart().startsWith(`${OUTCOME_UNKNOWN_ROW_PREFIX}:`);
 }
@@ -192,6 +229,7 @@ async function* runStreamInner(events, ctx, handle = {}) {
     const seen = new Set();
     if (ctx.startedAtMs === undefined)
         ctx.startedAtMs = Date.now();
+    const historyGeneration = openToolHistoryGeneration();
     const nestedUsageByTask = new Map();
     let usageMissingObserved = false;
     const toolInputByCallId = new Map();
@@ -478,7 +516,37 @@ async function* runStreamInner(events, ctx, handle = {}) {
                 const sessionUnreadable = ev.type === 'failed'
                     ? isCorruptSessionCode(ev.errorCode)
                     : doneTerminal?.kind === 'failed' && isCorruptSessionCode(doneTerminal.code);
-                yield syntheticTerminalRow(ctx, sessionUnreadable ? `${rowText}\n${corruptSessionContent()}` : rowText);
+                const historyMismatch = !busy.busy && !governance && !isModelOutputErrorText(errText)
+                    ? classifyToolHistoryMismatch({
+                        code: ev.type === 'failed' ? ev.errorCode : runTerminalCode(doneTerminal),
+                        status: ev.type === 'done' ? providerFailureStatusOf(ev.result) : undefined,
+                        message: errText,
+                    })
+                    : null;
+                const historyEchoedSid = ev.type === 'done' ? engineSessionIdOf(ev.result) : undefined;
+                const historyRepeat = noteToolHistoryTerminal({
+                    sessionId: historyEchoedSid ?? ctx.sessionId,
+                    sessionEchoed: historyEchoedSid !== undefined,
+                    generation: historyGeneration,
+                    runId: ev.type === 'done' ? engineRunIdOf(ev.result) : undefined,
+                    replay: ev.type === 'done' && ev.replay === true,
+                    mismatch: historyMismatch,
+                });
+                const rewindLine = historyMismatch !== null && ctx.lane !== 'print' && ctx.lane !== 'utility' && toolHistoryRewindOffered(ctx.offersRewind)
+                    ? `\n${TOOL_HISTORY_REWIND_SENTENCE}${historyRepeat !== undefined && historyRepeat >= 2 ? ` ${toolHistoryRepeatSentence(historyRepeat)}` : ''}`
+                    : '';
+                yield syntheticTerminalRow(ctx, `${sessionUnreadable ? `${rowText}\n${corruptSessionContent()}` : rowText}${rewindLine}`, historyMismatch === null ? undefined : toolHistoryMismatchRowKey(historyMismatch, historyRepeat));
+            }
+            else {
+                const echoedSid = ev.type === 'done' ? engineSessionIdOf(ev.result) : undefined;
+                noteToolHistoryTerminal({
+                    sessionId: echoedSid ?? ctx.sessionId,
+                    sessionEchoed: echoedSid !== undefined,
+                    generation: historyGeneration,
+                    runId: ev.type === 'done' ? engineRunIdOf(ev.result) : undefined,
+                    replay: ev.type === 'done' && ev.replay === true,
+                    mismatch: null,
+                });
             }
             if (ev.type === 'done' && isReviewPark(doneTerminal) && ctx.emitChrome) {
                 try {
@@ -514,6 +582,11 @@ async function* runStreamInner(events, ctx, handle = {}) {
             yield resultFrame;
             return;
         }
+        if (ev.type === 'suspended') {
+            const notice = suspendedReopenedNotice(ev);
+            if (notice !== undefined)
+                emitChromeFireAndForget(ctx, notice);
+        }
         const projection = eventToSdkMessage(ev, ctx);
         if (projection.kind === 'message') {
             yield projection.message;

package/dist/adapter/types.d.ts

@@ -18,6 +18,9 @@ export interface EmitContext {
     startedAtMs?: number;
     model?: string;
     lane?: RequestLane;
+    offersRewind?: boolean | {
+        readonly engineBaseUrl: string;
+    };
     emitChrome?(event: ChromeEvent): void | Promise<void>;
     onDroppedFrame?(info: DroppedFrameInfo): void;
 }

package/dist/agentSession/backgroundView.js

@@ -2,6 +2,7 @@ import { abortableSleep } from '../abortableSleep.js';
 import { errCodes } from '../controlRouter.js';
 import { engineWireDebugEnabled } from '../engineWireTarget.js';
 import { hostLog } from '../host.js';
+import { isReadCredentialRefusal } from '../readCredentialRefusal.js';
 export function backgroundStatusFromAssistant(s) {
     switch (s) {
         case 'running':
@@ -169,7 +170,12 @@ export function createBackgroundView(client, opts) {
         }
         catch (err) {
             debugLog(`fleet.snapshot degrade: ${String(err)}`);
-            return { health: isNotImplemented(err) ? 'not-configured' : 'unavailable', tasks: [] };
+            const health = isNotImplemented(err)
+                ? 'not-configured'
+                : isReadCredentialRefusal(err)
+                    ? 'unauthorized'
+                    : 'unavailable';
+            return { health, tasks: [] };
         }
     }
     async function pollOnce() {

package/dist/agentSession/contract.d.ts

@@ -47,7 +47,7 @@ export type AttachSeatSession = (seatApi: unknown) => AgentSession & {
     readonly supportedFields: readonly string[];
 };
 export type BackgroundSource = 'assistant' | 'fleet';
-export type BackgroundSourceHealth = 'ok' | 'unavailable' | 'not-configured';
+export type BackgroundSourceHealth = 'ok' | 'unavailable' | 'not-configured' | 'unauthorized';
 export type BackgroundStatus = 'running' | 'waiting-on-human' | 'queued' | 'stopping' | 'done' | 'failed' | 'stopped' | 'unknown';
 export interface BackgroundRow {
     readonly key: {

package/dist/centerWiringCapability.d.ts

@@ -0,0 +1,38 @@
+export interface CenterWiringRevisionView {
+    version: number;
+    updatedAt: string;
+}
+export interface CenterWiringCallerView {
+    lease: string;
+    retryAfterSec?: number;
+}
+export interface CenterWiringView {
+    effectivePull: boolean;
+    effectiveRevision: CenterWiringRevisionView | null;
+    lease: string;
+    leaseHealth?: string;
+    failMode?: string;
+    usageReport: boolean;
+    issuer: string;
+    caller?: CenterWiringCallerView;
+}
+export type CenterWiringReading = {
+    kind: 'unobserved';
+} | {
+    kind: 'not_reported';
+} | {
+    kind: 'none';
+} | {
+    kind: 'present';
+    view: CenterWiringView;
+};
+export declare function projectCenterWiringCapability(caps: unknown): CenterWiringReading | undefined;
+export declare function noteEngineCapsForCenterWiring(baseUrl: string, caps: unknown, opts?: {
+    generation?: number;
+}): void;
+export declare function observedCenterWiring(baseUrl?: string | undefined): CenterWiringReading;
+export type CallerQuotaLease = 'enforced' | 'not-enforced' | 'exhausted' | 'unobserved' | 'no-lease' | 'unknown';
+export declare function callerQuotaLease(reading: CenterWiringReading): CallerQuotaLease;
+export declare function centerWiringDoctorDetail(reading: CenterWiringReading): string;
+export declare function forgetCenterWiringReading(baseUrl: string | undefined): void;
+export declare function __resetCenterWiringReadingsForTests(): void;

package/dist/centerWiringCapability.js

@@ -0,0 +1,202 @@
+import { capForDisplay } from './fleetTaskDesc.js';
+import { engineWireTarget } from './engineWireTarget.js';
+import { capsGenerationOf, createEngineCapReader } from './engineCapReader.js';
+const nonEmpty = (v) => typeof v === 'string' && v !== '';
+const isPlainObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+function optionalSeat(o, key) {
+    if (!Object.hasOwn(o, key))
+        return { state: 'absent' };
+    const value = o[key];
+    return value === undefined ? { state: 'absent' } : { state: 'value', value };
+}
+export function projectCenterWiringCapability(caps) {
+    try {
+        return projectCenterWiringOf(caps);
+    }
+    catch {
+        return undefined;
+    }
+}
+function projectCenterWiringOf(caps) {
+    if (!isPlainObject(caps))
+        return undefined;
+    const cw = Object.hasOwn(caps, 'centerWiring') ? caps.centerWiring : undefined;
+    if (cw === undefined)
+        return capsGenerationOf(caps).generation === 'new' ? { kind: 'none' } : { kind: 'not_reported' };
+    if (!isPlainObject(cw))
+        return undefined;
+    const effectivePull = cw.effectivePull;
+    const revisionRaw = cw.effectiveRevision;
+    const lease = cw.lease;
+    const usageReport = cw.usageReport;
+    const issuer = cw.issuer;
+    if (typeof effectivePull !== 'boolean' || typeof usageReport !== 'boolean')
+        return undefined;
+    if (!nonEmpty(lease) || !nonEmpty(issuer))
+        return undefined;
+    let effectiveRevision;
+    if (revisionRaw === null) {
+        effectiveRevision = null;
+    }
+    else {
+        if (!isPlainObject(revisionRaw))
+            return undefined;
+        const version = revisionRaw.version;
+        const updatedAt = revisionRaw.updatedAt;
+        if (typeof version !== 'number' || !Number.isFinite(version) || !nonEmpty(updatedAt))
+            return undefined;
+        effectiveRevision = { version, updatedAt };
+    }
+    const health = optionalSeat(cw, 'leaseHealth');
+    if (health.state === 'value' && !nonEmpty(health.value))
+        return undefined;
+    const mode = optionalSeat(cw, 'failMode');
+    if (mode.state === 'value' && !nonEmpty(mode.value))
+        return undefined;
+    const callerSeat = optionalSeat(cw, 'caller');
+    let caller;
+    if (callerSeat.state === 'value') {
+        if (!isPlainObject(callerSeat.value))
+            return undefined;
+        const callerLease = callerSeat.value.lease;
+        if (!nonEmpty(callerLease))
+            return undefined;
+        const wait = optionalSeat(callerSeat.value, 'retryAfterSec');
+        if (wait.state === 'value' && (typeof wait.value !== 'number' || !Number.isFinite(wait.value) || wait.value < 0))
+            return undefined;
+        caller = { lease: callerLease, ...(wait.state === 'value' ? { retryAfterSec: wait.value } : {}) };
+    }
+    return {
+        kind: 'present',
+        view: {
+            effectivePull,
+            effectiveRevision,
+            lease,
+            ...(health.state === 'value' ? { leaseHealth: health.value } : {}),
+            ...(mode.state === 'value' ? { failMode: mode.value } : {}),
+            usageReport,
+            issuer,
+            ...(caller !== undefined ? { caller } : {}),
+        },
+    };
+}
+const reader = createEngineCapReader({
+    name: 'centerWiring',
+    project: projectCenterWiringCapability,
+    makeUnobserved: () => ({ kind: 'unobserved' }),
+});
+export function noteEngineCapsForCenterWiring(baseUrl, caps, opts) {
+    reader.note(baseUrl, caps, opts);
+}
+export function observedCenterWiring(baseUrl = engineWireTarget()?.baseUrl) {
+    return reader.observed(baseUrl);
+}
+function guarded(reading) {
+    if (typeof reading !== 'object' || reading === null)
+        return undefined;
+    try {
+        const kind = reading.kind;
+        if (kind === 'not_reported' || kind === 'unobserved' || kind === 'none')
+            return { kind };
+        if (kind !== 'present')
+            return undefined;
+        const view = reading.view;
+        return isPlainObject(view) ? { kind: 'present', view } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function callerQuotaLease(reading) {
+    const r = guarded(reading);
+    if (r === undefined)
+        return 'unknown';
+    if (r.kind === 'none')
+        return 'no-lease';
+    if (r.kind !== 'present')
+        return 'unknown';
+    try {
+        const lease = r.view.lease;
+        if (lease === 'absent')
+            return 'no-lease';
+        if (lease !== 'configured')
+            return 'unknown';
+        const caller = r.view.caller;
+        if (!isPlainObject(caller))
+            return 'unknown';
+        const callerLease = caller.lease;
+        return callerLease === 'enforced' || callerLease === 'not-enforced' || callerLease === 'exhausted' || callerLease === 'unobserved' ? callerLease : 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+const WORD_DETAIL_MAX = 40;
+const word = (v) => capForDisplay(v, WORD_DETAIL_MAX);
+function healthClause(v) {
+    if (v === undefined)
+        return 'lease health not reported';
+    if (v === 'ok')
+        return 'the quota service is answering';
+    if (v === 'auth-rejected')
+        return "the quota service rejected this engine's credentials";
+    if (v === 'unreachable')
+        return 'the quota service could not be reached';
+    if (v === 'unobserved')
+        return 'no lease negotiated yet';
+    return nonEmpty(v) ? `lease health reported as "${word(v)}"` : 'lease health not reported';
+}
+function failModeClause(v) {
+    if (v === undefined)
+        return 'failure posture not reported';
+    if (v === 'closed')
+        return 'billed requests are refused while a budget cannot be confirmed';
+    if (v === 'open')
+        return 'billed requests are let through while a budget cannot be confirmed';
+    return nonEmpty(v) ? `failure posture reported as "${word(v)}"` : 'failure posture not reported';
+}
+export function centerWiringDoctorDetail(reading) {
+    const unobserved = 'center wiring not observed — the engine reports it on /v1/capabilities; this process has no usable capabilities reading cached for it, so whether this engine is connected to a configuration center is unknown';
+    const r = guarded(reading);
+    if (r?.kind === 'not_reported') {
+        return 'center wiring not reported by this engine — only newer engines advertise it; this does not say whether the engine is connected to a configuration center';
+    }
+    if (r?.kind === 'none') {
+        return 'no configuration center on this deployment — the engine runs on its own local configuration; no quota lease or usage reporting goes through a center';
+    }
+    if (r?.kind !== 'present')
+        return unobserved;
+    try {
+        const v = r.view;
+        const pull = v.effectivePull === true ? 'configuration pulled from the center' : 'latest configuration pull did not succeed (running on what it already had)';
+        const rev = v.effectiveRevision;
+        const revision = isPlainObject(rev) && typeof rev.version === 'number' && Number.isFinite(rev.version) ? `revision ${String(rev.version)} in effect` : 'no revision in effect yet';
+        const lease = v.lease;
+        const leasePart = lease === 'absent'
+            ? 'quota lease not configured'
+            : lease === 'configured'
+                ? `quota lease configured (${healthClause(v.leaseHealth)}; ${failModeClause(v.failMode)})`
+                : nonEmpty(lease)
+                    ? `quota lease reported as "${word(lease)}"`
+                    : 'quota lease not reported';
+        const usage = v.usageReport === true ? 'usage reporting on' : 'usage reporting off';
+        const iss = v.issuer;
+        const issuer = iss === 'explicit'
+            ? 'token issuer set explicitly'
+            : iss === 'fallback'
+                ? 'token issuer defaults to the center'
+                : nonEmpty(iss)
+                    ? `token issuer reported as "${word(iss)}"`
+                    : 'token issuer not reported';
+        return `connected to a configuration center — ${pull}, ${revision} · ${leasePart} · ${usage} · ${issuer}`;
+    }
+    catch {
+        return unobserved;
+    }
+}
+export function forgetCenterWiringReading(baseUrl) {
+    reader.forget(baseUrl);
+}
+export function __resetCenterWiringReadingsForTests() {
+    reader.__resetForTests();
+}

package/dist/decideFailureNote.js

@@ -1,13 +1,16 @@
 import { corruptStoredRowContent, corruptStoredRowWhere } from './wireErrorTriage.js';
 import { parkedResumeStartupContent, parkedResumeStartupFromError, resumePolicyBlockContent, resumePolicyBlockFromError, } from './resumeRefusalCopy.js';
 import { decideParkMovedContent, decideParkMovedFromError } from './decideReceipt.js';
+import { settingsPermissionBucketRefusalContent, settingsPermissionBucketRefusalFromError } from './wireRefusalCopy.js';
 export function decideFailureNote(err, decision) {
     const where = corruptStoredRowWhere(err);
     const fold = resumePolicyBlockFromError(err);
     const startup = parkedResumeStartupFromError(err, decision);
     const moved = decideParkMovedFromError(err);
+    const bucket = settingsPermissionBucketRefusalFromError(err);
     return ((where === undefined ? '' : ` — ${corruptStoredRowContent(where)}`) +
         (fold === null ? '' : ` — ${resumePolicyBlockContent(fold)}`) +
+        (bucket === null ? '' : ` — ${settingsPermissionBucketRefusalContent(bucket)}`) +
         (startup === null ? '' : ` — ${parkedResumeStartupContent(startup)}`) +
         (moved === null ? '' : ` — ${decideParkMovedContent(moved)}`));
 }

package/dist/decideReceipt.d.ts

@@ -1,5 +1,5 @@
 import { type GateOutcomeView } from './gateOutcome.js';
-import { type ResumeReopenDetail } from './resumeRefusalCopy.js';
+import { type ResumeReopenDetail } from './hitl/suspendedReopen.js';
 export interface DecideReceiptView {
     status?: string;
     taskId?: string;

package/dist/decideReceipt.js

@@ -1,5 +1,5 @@
 import { gateOutcomeOf } from './gateOutcome.js';
-import { resumeReopenFromError } from './resumeRefusalCopy.js';
+import { resumeReopenFromError } from './hitl/suspendedReopen.js';
 import { DECIDE_CLAIM_LOST, DECIDE_GATE_MOVED, DECIDE_NOT_PARKED, DECIDE_WORKFLOW_HOST_UNKNOWN, DECIDE_WORKFLOW_LANE_CODES, DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED, isDecideParkMovedCode, } from './engineErrorCodes.js';
 import { effectiveWireErrorCode } from './wireErrorTriage.js';
 import { readErrorString } from './wireFailureShape.js';

package/dist/detachWire.d.ts

@@ -1,4 +1,5 @@
 import { type EnvLike } from './hostEnv.js';
+import { type WireAuthTokenSource } from './engineWireSdk.js';
 export declare const DETACH_HEADER = "x-detach-on-disconnect";
 export declare const HEADLESS_DETACH_ENV = "SEMA_HEADLESS_DETACH";
 export declare const DETACH_WIRE_MIN_ENGINE: readonly [number, number, number];
@@ -36,7 +37,11 @@ export interface DetachCancelArm {
     principal: string | undefined;
     getTaskId: () => string | null;
 }
-export declare function armDetachCancel(arm: DetachCancelArm): void;
+export declare function armDetachCancel(arm: Omit<DetachCancelArm, 'authToken'> & {
+    authToken: WireAuthTokenSource | {
+        mode: 'loopback-unauthed';
+    };
+}): void;
 export declare function isDetachArmed(): boolean;
 export declare function detachedTaskId(): string | null;
 export declare function detachCancelArm(): DetachCancelArm | null;

package/dist/detachWire.js

@@ -1,6 +1,7 @@
 import { hostEnv } from './hostEnv.js';
 import { envFlagOff } from './envFlag.js';
 import { versionSupportsLimits } from './limitsWire.js';
+import { resolveWireAuth } from './engineWireSdk.js';
 export const DETACH_HEADER = 'x-detach-on-disconnect';
 export const HEADLESS_DETACH_ENV = 'SEMA_HEADLESS_DETACH';
 export const DETACH_WIRE_MIN_ENGINE = [1, 196, 0];
@@ -80,6 +81,17 @@ let cancelArm = null;
 export function armDetachCancel(arm) {
     cancelArm = arm;
 }
+function armAuthNow(baseUrl, source) {
+    let token;
+    try {
+        const v = source();
+        token = typeof v === 'string' ? v : undefined;
+    }
+    catch {
+        token = undefined;
+    }
+    return resolveWireAuth(baseUrl, token);
+}
 export function isDetachArmed() {
     return cancelArm !== null;
 }
@@ -87,7 +99,16 @@ export function detachedTaskId() {
     return cancelArm?.getTaskId() ?? null;
 }
 export function detachCancelArm() {
-    return cancelArm;
+    const arm = cancelArm;
+    if (arm === null)
+        return null;
+    const source = arm.authToken;
+    if (typeof source === 'function') {
+        const view = Object.defineProperties(Object.create(Object.getPrototypeOf(arm)), Object.getOwnPropertyDescriptors(arm));
+        Object.defineProperty(view, 'authToken', { value: armAuthNow(arm.baseUrl, source), enumerable: true, writable: true, configurable: true });
+        return view;
+    }
+    return arm;
 }
 export function _resetDetachWireForTest() {
     cancelArm = null;

package/dist/engineCapReader.d.ts

@@ -12,4 +12,12 @@ interface EngineCapReader<R> {
     __resetForTests(): void;
 }
 export declare function createEngineCapReader<R>(spec: EngineCapReaderSpec<R>): EngineCapReader<R>;
+export type CapsGeneration = {
+    generation: 'new';
+    store: object;
+} | {
+    generation: 'old';
+    store: 'absent' | 'malformed';
+};
+export declare function capsGenerationOf(caps: object): CapsGeneration;
 export {};

package/dist/engineCapReader.js

@@ -43,3 +43,18 @@ export function createEngineCapReader(spec) {
         },
     };
 }
+export function capsGenerationOf(caps) {
+    try {
+        if (!Object.hasOwn(caps, 'store'))
+            return { generation: 'old', store: 'absent' };
+        const store = caps.store;
+        if (store === undefined)
+            return { generation: 'old', store: 'absent' };
+        if (typeof store !== 'object' || store === null || Array.isArray(store))
+            return { generation: 'old', store: 'malformed' };
+        return { generation: 'new', store };
+    }
+    catch {
+        return { generation: 'old', store: 'malformed' };
+    }
+}

package/dist/engineErrorCodes.d.ts

@@ -5,6 +5,7 @@ export declare const LIMITS_MAX_WALLTIME_EXCEEDED = "limits.max_walltime_exceede
 export declare function isLimitsExceededCode(code: string | undefined): boolean;
 export declare const USAGE_WINDOW_EXHAUSTED = "usage.window_exhausted";
 export declare const ENV_LIFETIME_EXPIRED = "env.lifetime_expired";
+export declare const FLEET_LEASE_UNAVAILABLE = "fleet.lease_unavailable";
 export declare const CONFIG_LIMIT_INVALID = "config.limit_invalid";
 export declare const CONFIG_STRATEGY_FIND_LIMIT_INVALID = "config.strategy_find_limit_invalid";
 export declare const CONFIG_STRATEGY_MAX_SIZE_INVALID = "config.strategy_max_size_invalid";
@@ -14,6 +15,8 @@ export declare const CONFIG_MEMORY_PROJECT_KEY_SPELLING = "config.memory_project
 export declare const CONFIG_MEMORY_WRITE_SCOPE_MISMATCH = "config.memory_write_scope_mismatch";
 export declare const CONFIG_LEGACY_TOOL_NAME = "config.legacy_tool_name";
 export declare const CONFIG_REFUSAL_CODES: ReadonlySet<string>;
+export declare const RULES_LEGACY_TOOL_NAME = "rules.legacy_tool_name";
+export declare function isRulesRefusalCode(code: string | undefined): boolean;
 export declare const DELEGATION_CONCURRENCY_CAP = "delegation.concurrency_cap";
 export declare const DELEGATION_SESSION_CAP = "delegation.session_cap";
 export declare const DELEGATION_CAP_CODES: ReadonlySet<string>;