@sema-agent/client-core 0.93.1 → 0.95.0

package/dist/gateOutcome.js

@@ -1,6 +1,7 @@
 import { ccToolDenialKindForSettledBy, isCcToolDenialKind, isGateDeniedByWord } from './gateVocabulary.js';
 import { GATE_PARKED_ERROR_CODE } from './engineErrorCodes.js';
 import { CORE_MODE_RELEASE_REASONS, CORE_SETTLEMENT_KINDS } from './generated/engineFactTables.js';
+import { readAskOrigin } from './ownKey.js';
 function str(v) {
     return typeof v === 'string' && v.length > 0 ? v : undefined;
 }
@@ -32,7 +33,8 @@ function readSettlement(v) {
     const who = readWho(s.who);
     if (kind === undefined || who === undefined)
         return undefined;
-    const when = typeof s.when === 'number' && Number.isFinite(s.when) ? s.when : undefined;
+    const whenRaw = s.when;
+    const when = typeof whenRaw === 'number' && Number.isFinite(whenRaw) ? whenRaw : undefined;
     const note = str(s.note);
     return {
         kind,
@@ -62,7 +64,7 @@ function readModeRelease(raw) {
     const classes = nonEmptyStringList(r.classes);
     if (mode === undefined || askClass === undefined || classes === undefined)
         return undefined;
-    const origin = str(r.origin);
+    const origin = readAskOrigin(r);
     const mandate = str(r.mandate);
     const reason = str(r.reason);
     return {
@@ -94,7 +96,7 @@ function readClassifierRound(raw) {
     }
     return view;
 }
-export function gateOutcomeOf(frame) {
+function readGateRecord(frame) {
     if (typeof frame !== 'object' || frame === null || Array.isArray(frame))
         return undefined;
     const g = frame.gate;
@@ -107,7 +109,9 @@ export function gateOutcomeOf(frame) {
     const dr = d;
     const dk = str(dr.kind);
     let disposition;
-    const classifier = readClassifierRound(dr.classifier);
+    let causePresent = false;
+    const classifierRaw = dr.classifier;
+    const classifier = readClassifierRound(classifierRaw);
     if (dk === 'allowed') {
         const released = readModeRelease(dr.released);
         disposition = {
@@ -120,7 +124,9 @@ export function gateOutcomeOf(frame) {
         const deniedBy = str(dr.deniedBy);
         if (deniedBy === undefined)
             return undefined;
-        const cause = str(dr.cause);
+        const causeRaw = dr.cause;
+        causePresent = causeRaw !== undefined;
+        const cause = str(causeRaw);
         const mode = str(dr.mode);
         const askClass = str(dr.askClass);
         const classes = nonEmptyStringList(dr.classes);
@@ -137,14 +143,23 @@ export function gateOutcomeOf(frame) {
     else {
         return undefined;
     }
-    const settlement = readSettlement(raw.settlement);
-    const origin = str(raw.origin);
+    const settlementRaw = raw.settlement;
+    const settlement = readSettlement(settlementRaw);
+    const origin = readAskOrigin(raw);
     return {
-        disposition,
-        ...(settlement !== undefined ? { settlement } : {}),
-        ...(origin !== undefined ? { origin } : {}),
+        view: {
+            disposition,
+            ...(settlement !== undefined ? { settlement } : {}),
+            ...(origin !== undefined ? { origin } : {}),
+        },
+        settlementPresent: settlementRaw !== undefined,
+        causePresent,
+        classifierPresent: classifierRaw !== undefined,
     };
 }
+export function gateOutcomeOf(frame) {
+    return readGateRecord(frame)?.view;
+}
 export function isGateParkedToolEnd(frame) {
     if (typeof frame !== 'object' || frame === null || Array.isArray(frame))
         return false;
@@ -171,6 +186,9 @@ export function isDenialLimitAutoDeniedGate(g) {
 export function isParkSlaExpiredGate(g) {
     return g?.settlement?.kind === 'park_sla_expired';
 }
+export function isApproverUnavailableGate(g) {
+    return isDeniedGate(g) && g?.settlement?.kind === 'approver_unavailable';
+}
 export function isHumanSettledGate(g) {
     const k = g?.settlement?.kind;
     return k === 'human_allowed' || k === 'human_refused';
@@ -186,21 +204,19 @@ export function ccToolDenialKindForToolEnd(frame) {
         return stamped;
     if (frame._sema_denial_unclassified === true)
         return undefined;
-    const outcome = gateOutcomeOf(frame);
+    const record = readGateRecord(frame);
+    const outcome = record?.view;
     const kind = outcome?.settlement?.kind;
     if (kind === 'human_refused')
         return ccToolDenialKindForSettledBy('human');
     if (kind === 'policy_refused')
         return ccToolDenialKindForSettledBy('policy');
-    const rawGate = frame.gate;
-    const settlementAbsent = typeof rawGate === 'object' && rawGate !== null && rawGate.settlement === undefined;
-    if (outcome !== undefined && settlementAbsent && outcome.disposition.kind === 'denied') {
+    if (record !== undefined && outcome !== undefined && !record.settlementPresent && outcome.disposition.kind === 'denied') {
         const by = outcome.disposition.deniedBy;
         if (by === 'ask_resolution' || !isGateDeniedByWord(by))
             return undefined;
         if (DENIED_BY_MAY_CARRY_CAUSE.has(by)) {
-            const rawDisposition = rawKeyOf(rawGate, 'disposition');
-            if (rawKeyOf(rawDisposition, 'cause') !== undefined) {
+            if (record.causePresent) {
                 const cause = outcome.disposition.cause;
                 if (cause === 'unavailable')
                     return 'automode-unavailable';
@@ -210,14 +226,13 @@ export function ccToolDenialKindForToolEnd(frame) {
             }
             if (by === 'classifier')
                 return 'automode-blocked';
-            if (rawKeyOf(rawDisposition, 'classifier') !== undefined)
+            if (record.classifierPresent)
                 return undefined;
         }
         return ccToolDenialKindForSettledBy('policy');
     }
     return undefined;
 }
-const rawKeyOf = (holder, key) => typeof holder === 'object' && holder !== null ? holder[key] : undefined;
 const DENIED_BY_MAY_CARRY_CAUSE = new Set(['classifier', 'policy']);
 const _gateOutcomeShapePin = (w) => w;
 void _gateOutcomeShapePin;

package/dist/gateVocabulary.js

@@ -69,7 +69,7 @@ export function askOriginDetail(origin) {
     return `this call asks; its origin ${word} is a word newer than this client, so answer it as usual`;
 }
 export function mandatedApprovalDetail() {
-    return 'no saved allow rule and no remembered answer can retire this question; each call is settled on its own — by you here, by a hook, or by an automatic check the deployment runs — and an answer covers only that call';
+    return 'no saved allow rule and no remembered answer can retire this question; each call is settled on its own — by you here or by an automatic check the deployment runs — and an answer covers only that call';
 }
 const _mandateWordsPin = true;
 void _mandateWordsPin;

package/dist/generated/engineAskFaceTables.d.ts

@@ -0,0 +1,3 @@
+export declare const CORE_ASK_FACES: readonly ["shell", "other"];
+export declare const CORE_SHELL_FACE_TOOL_NAMES: readonly string[];
+export declare const CORE_RELEASABLE_ASK_CLASSES_BY_FACE: Readonly<Record<(typeof CORE_ASK_FACES)[number], readonly string[]>>;

package/dist/generated/engineAskFaceTables.js

@@ -0,0 +1,12 @@
+export const CORE_ASK_FACES = Object.freeze([
+    "shell",
+    "other",
+]);
+export const CORE_SHELL_FACE_TOOL_NAMES = Object.freeze([
+    "Bash",
+    "Monitor",
+]);
+export const CORE_RELEASABLE_ASK_CLASSES_BY_FACE = Object.freeze({
+    "shell": Object.freeze(["transcript_write", "rule_unreadable", "write_protection_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "artifact_shared_read", "mode", "unstated", "ordinary"]),
+    "other": Object.freeze(["transcript_write", "rule_unreadable", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "artifact_shared_read", "mode", "unstated", "ordinary"]),
+});

package/dist/generated/engineFactTables.d.ts

@@ -8,7 +8,7 @@ export declare const CORE_DENIED_BY_VALUES: readonly ["policy", "hook", "org", "
 export declare const CORE_PERMISSION_MODE_FOLD_REASONS: readonly string[];
 export declare const CORE_ENGINE_CARD_TYPES: readonly string[];
 export declare const CORE_TOOL_DECLARATION_CODES: readonly string[];
-export declare const CORE_MODE_RELEASE_REASONS: readonly ["rule_unreadable"];
+export declare const CORE_MODE_RELEASE_REASONS: readonly ["rule_unreadable", "write_protection_unresolved"];
 export declare const CORE_HOOK_TOOL_ALIASES: Readonly<Record<string, string>>;
 export declare const CORE_ASK_EVIDENCE_ABSENCE_VALUES: readonly ["not_wired", "not_adjudicated", "unavailable", "no_match", "not_reported"];
 export declare const CORE_SYSTEM_INJECTION_PRIORITIES: readonly ["now", "next", "later"];
@@ -21,7 +21,7 @@ export interface CoreModeArbitrationRow {
     readonly ruleMayClear: boolean;
     readonly hookAskFloor: boolean;
 }
-export declare const CORE_MODE_ARBITRATION: Readonly<Record<"content_question" | "hook" | "ancestor" | "unverifiable_delete" | "transcript_write" | "org_rule" | "governance_unavailable" | "rule_unreadable" | "ask_rule" | "denial_limit_fallback" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "write_protection_unresolved" | "probe" | "write_protection" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "mode" | "unstated" | "ordinary", CoreModeArbitrationRow>>;
+export declare const CORE_MODE_ARBITRATION: Readonly<Record<"content_question" | "hook" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "org_rule" | "governance_unavailable" | "rule_unreadable" | "ask_rule" | "denial_limit_fallback" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "write_protection_unresolved" | "probe" | "write_protection" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "mode" | "unstated" | "ordinary", CoreModeArbitrationRow>>;
 export declare const CORE_SKILL_GRANT_ORIGINS: readonly ["model", "user", "inherited"];
 export declare const CORE_ALLOW_ENTRY_INERT_REASONS: readonly ["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar", "tool_name", "near_miss"];
 export declare const CORE_ALLOW_RULE_MEMBERS: readonly ["hook", "deployment", "persisted", "skill", "request"];
@@ -38,3 +38,5 @@ export declare const CORE_RULE_BEHAVIORS: readonly ["deny", "ask", "allow"];
 export declare const CORE_MCP_IMAGE_MAX_BASE64: number;
 export declare const CORE_MAX_PENDING_STEER_CHARS: number;
 export declare const CORE_PROMPT_BLOCK_CAUSES: readonly ["block", "crashed", "timeout", "cancelled"];
+export declare const CORE_PERMISSION_MODES: readonly ["default", "acceptEdits", "plan", "auto", "bypassPermissions", "dontAsk"];
+export declare const CORE_APPROVAL_REACH: readonly ["none"];

package/dist/generated/engineFactTables.js

@@ -113,6 +113,7 @@ export const CORE_TOOL_DECLARATION_CODES = Object.freeze([
 ]);
 export const CORE_MODE_RELEASE_REASONS = Object.freeze([
     "rule_unreadable",
+    "write_protection_unresolved",
 ]);
 export const CORE_HOOK_TOOL_ALIASES = Object.freeze(Object.assign(Object.create(null), Object.fromEntries([
     ["ListPeers", "ListAgents"],
@@ -144,6 +145,7 @@ export const CORE_MODE_ARBITRATION = Object.freeze({
     "content_question": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true }),
     "hook": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
     "ancestor": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
+    "dangerous_delete": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true }),
     "unverifiable_delete": Object.freeze({ bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true }),
     "transcript_write": Object.freeze({ bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true }),
     "org_rule": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
@@ -255,3 +257,14 @@ export const CORE_PROMPT_BLOCK_CAUSES = Object.freeze([
     "timeout",
     "cancelled",
 ]);
+export const CORE_PERMISSION_MODES = Object.freeze([
+    "default",
+    "acceptEdits",
+    "plan",
+    "auto",
+    "bypassPermissions",
+    "dontAsk",
+]);
+export const CORE_APPROVAL_REACH = Object.freeze([
+    "none",
+]);

package/dist/generated/engineNoticeTables.d.ts

@@ -4,3 +4,8 @@ export declare const CORE_MCP_INJECTION_DROP_REASONS: readonly string[];
 export declare const CORE_NOTICE_MINTER: Readonly<Record<string, 'engine' | 'server'>>;
 export declare const CORE_USER_INPUT_UNDRAINED_CAUSES: readonly ["leg_end", "crashed"];
 export declare const CORE_TOOL_TURN_INCOMPLETE_CAUSES: readonly ["truncated", "unnamed", "bad_frame", "missing_result_synthesized"];
+export interface CoreUserInputUndrainedFamily {
+    readonly code: string;
+    readonly countKey: string;
+}
+export declare const CORE_USER_INPUT_UNDRAINED_FAMILIES: Readonly<Record<"steer" | "followUp", CoreUserInputUndrainedFamily>>;

package/dist/generated/engineNoticeTables.js

@@ -28,6 +28,7 @@ export const CORE_ENGINE_NOTICE_CODES = Object.freeze([
     "permission.ask_released_by_mode",
     "permission.read_deny_unapplied",
     "permission.rule_store_unavailable",
+    "permission.rule_row_dropped",
     "permission.allowed_tool_not_granted",
     "peer.inbound_disposition",
     "peer.held_settled",
@@ -116,6 +117,7 @@ export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "permission.ask_released_by_mode": "user",
     "permission.read_deny_unapplied": "user",
     "permission.rule_store_unavailable": "user",
+    "permission.rule_row_dropped": "user",
     "permission.allowed_tool_not_granted": "user",
     "peer.inbound_disposition": "user",
     "peer.held_settled": "user",
@@ -210,6 +212,7 @@ export const CORE_NOTICE_MINTER = Object.freeze({
     "permission.ask_released_by_mode": "engine",
     "permission.read_deny_unapplied": "engine",
     "permission.rule_store_unavailable": "engine",
+    "permission.rule_row_dropped": "engine",
     "permission.allowed_tool_not_granted": "engine",
     "peer.inbound_disposition": "engine",
     "peer.held_settled": "engine",
@@ -278,3 +281,7 @@ export const CORE_TOOL_TURN_INCOMPLETE_CAUSES = Object.freeze([
     "bad_frame",
     "missing_result_synthesized",
 ]);
+export const CORE_USER_INPUT_UNDRAINED_FAMILIES = Object.freeze({
+    "steer": Object.freeze({ code: "task.user_steer_undrained", countKey: "steer" }),
+    "followUp": Object.freeze({ code: "task.user_followup_undrained", countKey: "followUp" }),
+});

package/dist/generated/sdkFactTables.d.ts

@@ -0,0 +1,5 @@
+export declare const SDK_ABORT_CAUSES: readonly ["client_disconnected", "ask_park_grace_exhausted", "cancel_verb"];
+export declare const SDK_STATUS_DERIVED_COARSE_CODES: readonly ["request.rejected", "auth.unauthorized", "auth.forbidden", "not_found.resource", "request.payload_too_large", "request.unprocessable", "limit.rate_exceeded", "capability.unavailable", "internal.error"];
+export declare const SDK_DENY_REASON_ROUTING_FAILURE: "routing_failure_fail_closed";
+export declare const SDK_ASK_ROW_ENDING_CAUSES: readonly ["routing_failure_fail_closed", "run_cancelled", "run_exited", "batch_aborted", "batch_sibling_withdrawn", "batch_bound_elsewhere", "adhoc_leg_no_durable_domain", "orphan_ttl_exceeded", "crashed_before_park", "shutdown_before_park"];
+export declare const SDK_RUN_DEATH_VERDICT_CODES: readonly ["run.stalled", "run.orphaned", "approval.expired"];

package/dist/generated/sdkFactTables.js

@@ -0,0 +1,34 @@
+export const SDK_ABORT_CAUSES = Object.freeze([
+    "client_disconnected",
+    "ask_park_grace_exhausted",
+    "cancel_verb",
+]);
+export const SDK_STATUS_DERIVED_COARSE_CODES = Object.freeze([
+    "request.rejected",
+    "auth.unauthorized",
+    "auth.forbidden",
+    "not_found.resource",
+    "request.payload_too_large",
+    "request.unprocessable",
+    "limit.rate_exceeded",
+    "capability.unavailable",
+    "internal.error",
+]);
+export const SDK_DENY_REASON_ROUTING_FAILURE = "routing_failure_fail_closed";
+export const SDK_ASK_ROW_ENDING_CAUSES = Object.freeze([
+    "routing_failure_fail_closed",
+    "run_cancelled",
+    "run_exited",
+    "batch_aborted",
+    "batch_sibling_withdrawn",
+    "batch_bound_elsewhere",
+    "adhoc_leg_no_durable_domain",
+    "orphan_ttl_exceeded",
+    "crashed_before_park",
+    "shutdown_before_park",
+]);
+export const SDK_RUN_DEATH_VERDICT_CODES = Object.freeze([
+    "run.stalled",
+    "run.orphaned",
+    "approval.expired",
+]);

package/dist/generated/settingsSchemaFns.d.ts

@@ -0,0 +1,10 @@
+export declare const SETTINGS_AT_MENTION_MODES: readonly ["all", "none", "only"];
+export type SettingsAtMention = {
+    readonly mode: Exclude<(typeof SETTINGS_AT_MENTION_MODES)[number], 'only'>;
+} | {
+    readonly mode: 'only';
+    readonly models: readonly string[];
+};
+export declare const SETTINGS_IS_LOOPBACK_AUTH_HOST: (host: string) => boolean;
+export declare const SETTINGS_IS_HIERARCHICAL_URL: (raw: string) => boolean;
+export declare const SETTINGS_NARROW_AT_MENTION: (atMention: SettingsAtMention, available: ReadonlySet<string>) => SettingsAtMention;

package/dist/generated/settingsSchemaFns.js

@@ -0,0 +1,22 @@
+export const SETTINGS_AT_MENTION_MODES = Object.freeze([
+    "all",
+    "none",
+    "only",
+]);
+export const SETTINGS_IS_LOOPBACK_AUTH_HOST = function isLoopbackAuthHost(host) {
+    return host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]" || host === "::ffff:127.0.0.1";
+};
+export const SETTINGS_IS_HIERARCHICAL_URL = function isHierarchicalUrl(raw) {
+    if (!URL.canParse(raw))
+        return false;
+    const u = new URL(raw);
+    return u.href.startsWith(`${u.protocol}//`);
+};
+export const SETTINGS_NARROW_AT_MENTION = function narrowAtMention(atMention, available) {
+    if (atMention.mode !== "only")
+        return atMention;
+    const kept = atMention.models.filter((n) => available.has(n));
+    if (kept.length === atMention.models.length)
+        return atMention;
+    return kept.length > 0 ? { mode: "only", models: kept } : { mode: "none" };
+};

package/dist/generated/settingsSchemaTables.d.ts

@@ -1,5 +1,8 @@
 export declare const SETTINGS_ENGINE_OWNED_HOOK_EVENTS: readonly ["PreToolUse", "PostToolUse", "PostToolUseFailure", "PostToolBatch", "PreCompact", "PostCompact", "Stop", "StopFailure", "UserPromptSubmit"];
 export declare const SETTINGS_SECRET_LITERAL_RE: RegExp;
+export declare const SETTINGS_PRIVATE_KEY_PEM_HEADER: RegExp;
+export declare const SETTINGS_DEVICE_CODE_TTL_SECONDS = 900;
+export declare const SETTINGS_DEVICE_POLL_INTERVAL_SECONDS = 5;
 export declare const SETTINGS_TIER_GROUP_NAME_RE: RegExp;
 export declare const SETTINGS_BUDGET_NUMBER_KEYS: readonly ["maxBudgetUsd", "tpmLimit", "rpmLimit", "maxParallelRequests", "maxRunCostUsd", "maxIterations"];
 export declare const SETTINGS_BUDGET_STRING_KEYS: readonly ["mode", "budgetDuration", "enforcement"];

package/dist/generated/settingsSchemaTables.js

@@ -10,6 +10,9 @@ export const SETTINGS_ENGINE_OWNED_HOOK_EVENTS = Object.freeze([
     "UserPromptSubmit",
 ]);
 export const SETTINGS_SECRET_LITERAL_RE = Object.freeze(/^(sk-|gh[opus]_|github_pat_|xox[baprse]-|xapp-|bearer\s|basic\s|eyJ[A-Za-z0-9_-]{10,}\.|AKIA[0-9A-Z]{12,}|AIza[0-9A-Za-z_-]{20,}|-----BEGIN[A-Z0-9 ]*PRIVATE KEY)/i);
+export const SETTINGS_PRIVATE_KEY_PEM_HEADER = Object.freeze(/-----BEGIN[A-Z0-9 ]*PRIVATE KEY/i);
+export const SETTINGS_DEVICE_CODE_TTL_SECONDS = 900;
+export const SETTINGS_DEVICE_POLL_INTERVAL_SECONDS = 5;
 export const SETTINGS_TIER_GROUP_NAME_RE = Object.freeze(/^[a-z0-9][a-z0-9._-]*$/i);
 export const SETTINGS_BUDGET_NUMBER_KEYS = Object.freeze([
     "maxBudgetUsd",

package/dist/headlessPermissionModeWire.d.ts

@@ -3,10 +3,10 @@ import { type PermissionModesReading } from './permissionModesCapability.js';
 import { type EnvLike } from './hostEnv.js';
 export declare const HEADLESS_PERMISSION_MODE_ENV = "SEMA_HEADLESS_PERMISSION_MODE";
 export declare const HEADLESS_PERMISSION_WIRE_MODES: readonly PermissionMode[];
-export declare function normalizeShellPermissionModeForWire(mode: string | undefined, permissionModes?: PermissionModesReading): string | undefined;
+export declare function normalizeShellPermissionModeForWire(mode: string | undefined): string | undefined;
 export type HeadlessPermissionResolution = {
     fields: PermissionModeField;
-    source: 'flag' | 'env' | 'default' | 'absent';
+    source: 'flag' | 'env' | 'default';
     warning?: string;
 };
 export declare function permissionModeFromArgv(argv: readonly string[]): string | undefined;

package/dist/headlessPermissionModeWire.js

@@ -6,15 +6,10 @@ import { PERMISSION_MODE_WORDS } from './taskRequestWords.js';
 import { readOwnDataValue } from './ownKey.js';
 export const HEADLESS_PERMISSION_MODE_ENV = 'SEMA_HEADLESS_PERMISSION_MODE';
 export const HEADLESS_PERMISSION_WIRE_MODES = [...PERMISSION_MODE_WORDS];
-const SHELL_INTERNAL_MODE_TO_WIRE = new Map([
-    ['manual', 'default'],
-    ['dontAsk', 'default'],
-]);
-export function normalizeShellPermissionModeForWire(mode, permissionModes) {
+const SHELL_INTERNAL_MODE_TO_WIRE = new Map([['manual', 'default']]);
+export function normalizeShellPermissionModeForWire(mode) {
     if (mode === undefined)
         return undefined;
-    if (mode === 'dontAsk' && permissionModeAdmitted(permissionModes, mode))
-        return mode;
     return SHELL_INTERNAL_MODE_TO_WIRE.get(mode) ?? mode;
 }
 export function permissionModeFromArgv(argv) {
@@ -35,8 +30,9 @@ export function resolveHeadlessPermissionMode(argv, env = hostEnv(), permissionM
     const flagMode = permissionModeFromArgv(argv);
     if (flagMode !== undefined) {
         const snap = flagMode === 'dontAsk' ? dontAskSnapshot(permissionModes) : undefined;
-        const normalized = normalizeShellPermissionModeForWire(flagMode, snap);
-        return { fields: permissionModeField(normalized, { stampDefault: true, permissionModes: snap }), source: 'flag' };
+        const normalized = normalizeShellPermissionModeForWire(flagMode);
+        const projected = permissionModeField(normalized, { stampDefault: true, permissionModes: snap });
+        return { fields: projected.permissionMode !== undefined ? projected : permissionModeField('default', { stampDefault: true }), source: 'flag' };
     }
     const raw = env[HEADLESS_PERMISSION_MODE_ENV]?.trim();
     if (raw === undefined || raw === '') {
@@ -44,21 +40,15 @@ export function resolveHeadlessPermissionMode(argv, env = hostEnv(), permissionM
     }
     if (HEADLESS_PERMISSION_WIRE_MODES.includes(raw)) {
         const snap = raw === 'dontAsk' ? dontAskSnapshot(permissionModes) : undefined;
-        if (raw === 'dontAsk' && snap === undefined) {
-            const downgraded = {
-                fields: permissionModeField('default', { stampDefault: true }),
-                source: 'env',
-            };
-            if (!warnedInvalidEnv) {
-                warnedInvalidEnv = true;
-                downgraded.warning = `sema: ${HEADLESS_PERMISSION_MODE_ENV}="dontAsk" is only sent once this client knows the engine accepts that mode, and ${dontAskWithheldClause(permissionModes)} — this run uses "default"`;
-            }
-            return downgraded;
-        }
-        return {
+        const resolution = {
             fields: permissionModeField(raw, { stampDefault: true, permissionModes: snap }),
             source: 'env',
         };
+        if (raw === 'dontAsk' && resolution.fields.permissionMode !== 'dontAsk' && !warnedInvalidEnv) {
+            warnedInvalidEnv = true;
+            resolution.warning = `sema: ${HEADLESS_PERMISSION_MODE_ENV}="dontAsk" is only sent once this client knows the engine accepts that mode, and ${dontAskWithheldClause(permissionModes)} — this run uses "default"`;
+        }
+        return resolution;
     }
     const resolution = {
         fields: permissionModeField('default', { stampDefault: true }),

package/dist/headlessReconnectWire.js

@@ -1,23 +1,18 @@
 import { isSseIdleError, probeEngineAlive } from './sseIdleTriage.js';
 import { hostEnv } from './hostEnv.js';
+import { isSdkRunFrameSynthesizable } from './terminalStatuses.js';
+import { createStreamDrainingLegs } from './streamDrainingLegs.js';
+import { abortableSleep } from './abortableSleep.js';
 export const HEADLESS_RECONNECT_MAX = 2;
 function debugLog(msg) {
     if (hostEnv().SEMA_DEBUG) {
         console.error(`[sema] headless reconnect: ${msg}`);
     }
 }
-const RUN_ROW_TERMINAL_STATUSES = new Set([
-    'completed',
-    'failed',
-    'timeout',
-    'blocked',
-    'suspended',
-    'needs_review',
-]);
 export function terminalEventFromRunRow(row) {
     if (!row || typeof row.status !== 'string')
         return null;
-    if (RUN_ROW_TERMINAL_STATUSES.has(row.status)) {
+    if (isSdkRunFrameSynthesizable(row.status)) {
         if (row.result && typeof row.result === 'object') {
             return { type: 'done', result: row.result };
         }
@@ -49,6 +44,15 @@ export async function* withHeadlessR1Reconnect(live, deps) {
     let lastSeenSeq;
     const probe = deps.probeAlive ?? probeEngineAlive;
     let isRecoverableTear;
+    const drains = createStreamDrainingLegs();
+    let drainReopenAfterMs;
+    const terminalFromRunRow = async (taskId) => {
+        const row = await deps.getRun(taskId).catch(() => null);
+        const terminal = terminalEventFromRunRow(row);
+        if (terminal)
+            debugLog(`run row terminal (${String(row?.status)}) — synthesizing the terminal frame (R1b)`);
+        return terminal;
+    };
     for (;;) {
         if (deps.signal?.aborted)
             throw originalTearErr;
@@ -59,25 +63,37 @@ export async function* withHeadlessR1Reconnect(live, deps) {
         const taskId = deps.getTaskId();
         if (!taskId)
             throw originalTearErr;
-        if (attempts >= HEADLESS_RECONNECT_MAX) {
-            debugLog(`budget exhausted (${attempts}/${HEADLESS_RECONNECT_MAX}) — falling to the honest death path`);
-            throw originalTearErr;
+        if (drainReopenAfterMs !== undefined) {
+            const waitMs = drainReopenAfterMs;
+            drainReopenAfterMs = undefined;
+            await abortableSleep(waitMs, deps.signal ?? new AbortController().signal);
+            if (deps.signal?.aborted)
+                throw originalTearErr;
+            debugLog(`engine draining — reopening runs.events(${taskId}${lastSeenSeq !== undefined ? `, Last-Event-ID ${lastSeenSeq}` : ''}) after ${waitMs}ms (not counted against the reconnect budget)`);
+        }
+        else {
+            if (attempts >= HEADLESS_RECONNECT_MAX) {
+                debugLog(`budget exhausted (${attempts}/${HEADLESS_RECONNECT_MAX}) — falling to the honest death path`);
+                throw originalTearErr;
+            }
+            attempts++;
+            if (!(await probe(deps.baseUrl)))
+                throw originalTearErr;
+            debugLog(`attempt ${attempts}/${HEADLESS_RECONNECT_MAX} — switching to runs.events(${taskId}${lastSeenSeq !== undefined ? `, Last-Event-ID ${lastSeenSeq}` : ''})`);
         }
-        attempts++;
-        if (!(await probe(deps.baseUrl)))
-            throw originalTearErr;
-        debugLog(`attempt ${attempts}/${HEADLESS_RECONNECT_MAX} — switching to runs.events(${taskId}${lastSeenSeq !== undefined ? `, Last-Event-ID ${lastSeenSeq}` : ''})`);
         try {
             const cont = deps.openEvents(taskId, lastSeenSeq !== undefined ? String(lastSeenSeq) : undefined);
             for await (const ev of cont) {
                 if (deps.signal?.aborted)
                     return;
+                if (drains.see(ev))
+                    continue;
                 const rec = ev;
                 const t = rec?.type;
                 if (t === undefined)
                     continue;
                 if (t === 'error') {
-                    debugLog(`runs.events lane frame type=error code=${String(rec?.errorCode ?? rec?.code ?? '')} — SDK resumes with Last-Event-ID internally`);
+                    debugLog(`runs.events lane frame type=error code=${String(rec?.errorCode ?? rec?.code ?? '')} — not forwarded (the cap frame is resumed inside the SDK)`);
                     continue;
                 }
                 const seq = typeof rec?.id === 'string' && /^\d+$/.test(rec.id) ? Number(rec.id) : undefined;
@@ -94,16 +110,29 @@ export async function* withHeadlessR1Reconnect(live, deps) {
             }
             if (deps.signal?.aborted)
                 return;
+            const drained = drains.legEnded('returned');
+            if (drained !== undefined) {
+                if ('reconnectAfterMs' in drained) {
+                    drainReopenAfterMs = drained.reconnectAfterMs;
+                    continue;
+                }
+                debugLog(`runs.events kept ending on drain end frames (${drained.giveUp}) — checking the run row`);
+                const terminal = await terminalFromRunRow(taskId);
+                if (terminal) {
+                    yield terminal;
+                    return;
+                }
+                continue;
+            }
             debugLog('runs.events continuation ended without a terminal frame');
         }
         catch (contErr) {
+            drains.legEnded('threw');
             debugLog(`runs.events continuation failed: ${contErr instanceof Error ? contErr.message : String(contErr)}`);
             if (deps.signal?.aborted)
                 throw originalTearErr;
-            const row = await deps.getRun(taskId).catch(() => null);
-            const terminal = terminalEventFromRunRow(row);
+            const terminal = await terminalFromRunRow(taskId);
             if (terminal) {
-                debugLog(`run row terminal (${String(row?.status)}) — synthesizing the terminal frame (R1b)`);
                 yield terminal;
                 return;
             }

package/dist/hitl/allowRuleShadow.d.ts

@@ -18,4 +18,4 @@ export interface ApprovalAllowRuleShadow {
 export declare function readAllowRuleShadowFromWire(carrier: object | null | undefined, leg: 'frame' | 'row'): ApprovalAllowRuleShadow | undefined;
 export declare function readApprovalAllowRuleShadow(card: object | null | undefined): ApprovalAllowRuleShadow | undefined;
 export declare function approvalAllowRuleShadowed(card: object | null | undefined): boolean;
-export declare function legacyShadowedRuleTextOf(r: ApprovalAllowRuleShadow | undefined): string | undefined;
+export declare function allowRuleShadowSentence(card: object | null | undefined): string | undefined;

package/dist/hitl/allowRuleShadow.js

@@ -1,4 +1,5 @@
 import { CORE_ALLOW_RULE_MEMBERS } from '../generated/engineFactTables.js';
+import { quoteUntrustedForSentence } from '../displayUntrusted.js';
 const KNOWN_MEMBERS = new Set(CORE_ALLOW_RULE_MEMBERS);
 function freezeMember(m) {
     return Object.freeze({ ...m });
@@ -154,14 +155,54 @@ export function readApprovalAllowRuleShadow(card) {
 export function approvalAllowRuleShadowed(card) {
     return readApprovalAllowRuleShadow(card) !== undefined;
 }
-export function legacyShadowedRuleTextOf(r) {
-    if (r === undefined)
+const ENTRY_MAX = 4096;
+const MEMBER_MAX = 64;
+const ENTRIES_SHOWN = 5;
+const UNREADABLE_LINE = 'An allow rule matched this call but cannot clear it; which rule could not be read, so this one is confirmed individually.';
+function legacySingleEntry(shadow) {
+    if (shadow.unreadable === true || shadow.members.length !== 1)
         return undefined;
-    for (const m of r.members) {
-        if (m.member !== 'persisted' || m.entries === undefined)
-            continue;
-        const first = m.entries[0];
-        return typeof first === 'string' && first.trim() !== '' ? first : undefined;
+    const m = shadow.members[0];
+    if (m.member !== 'persisted' || m.malformed === true || m.omitted !== undefined)
+        return undefined;
+    if (m.entries === undefined || m.entries.length !== 1)
+        return undefined;
+    return quoteUntrustedForSentence(m.entries[0], ENTRY_MAX);
+}
+function memberPhrase(m) {
+    const memberWord = m.member === undefined ? undefined : KNOWN_MEMBERS.has(m.member) ? m.member : quoteUntrustedForSentence(m.member, MEMBER_MAX);
+    const word = memberWord ?? 'an unrecognised source';
+    const entries = m.entries ?? [];
+    if (m.malformed === true && entries.length === 0)
+        return `${word} (could not be read)`;
+    const listed = entries
+        .map((e) => quoteUntrustedForSentence(e, ENTRY_MAX))
+        .filter((e) => e !== undefined)
+        .slice(0, ENTRIES_SHOWN);
+    const notListed = entries.length - listed.length + (m.omitted ?? 0);
+    const parts = [];
+    if (listed.length > 0)
+        parts.push(listed.join(', '));
+    if (notListed > 0)
+        parts.push(listed.length > 0 ? `and ${String(notListed)} more not listed` : `${String(notListed)} not listed`);
+    if (m.malformed === true)
+        parts.push('part of it could not be read');
+    return parts.length > 0 ? `${word}: ${parts.join('; ')}` : word;
+}
+export function allowRuleShadowSentence(card) {
+    const shadow = readApprovalAllowRuleShadow(card);
+    if (shadow === undefined)
+        return undefined;
+    try {
+        if (shadow.unreadable === true || shadow.members.length === 0)
+            return UNREADABLE_LINE;
+        const legacy = legacySingleEntry(shadow);
+        if (legacy !== undefined) {
+            return `Your saved permission rule ${legacy} still exists — it just cannot clear this particular call, so this one is confirmed individually.`;
+        }
+        return `Allow rules matched this call but cannot clear it, so this one is confirmed individually — ${shadow.members.map(memberPhrase).join(' · ')}.`;
+    }
+    catch {
+        return UNREADABLE_LINE;
     }
-    return undefined;
 }

package/dist/hitl/approvalCompleteParked.d.ts

@@ -0,0 +1 @@
+export declare function approvalCompleteParked(frame: unknown): boolean;