@sema-agent/client-core 0.95.0 → 0.96.0

package/dist/generated/engineNoticeTables.js

@@ -14,7 +14,7 @@ export const CORE_ENGINE_NOTICE_CODES = Object.freeze([
     "config.artifact_host_invalid",
     "config.task_root_not_canonical",
     "config.write_protection_target_view_absent",
-    "config.write_protection_unresolved",
+    "config.path_view_unresolved",
     "config.execution_env_capability_invalid",
     "config.tool_card_undeclared",
     "config.tool_face_undeclared",
@@ -66,6 +66,9 @@ export const CORE_ENGINE_NOTICE_CODES = Object.freeze([
     "route.base_url_changed_key_unchanged",
     "route.response_model_mismatch",
     "route.tool_call_id_folded",
+    "route.finish_reason_unknown",
+    "route.stream_end_ignored",
+    "route.extra_body_reserved_dropped",
     "context.tool_turn_repaired",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
@@ -103,7 +106,7 @@ export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "config.artifact_host_invalid": "operator",
     "config.task_root_not_canonical": "operator",
     "config.write_protection_target_view_absent": "operator",
-    "config.write_protection_unresolved": "operator",
+    "config.path_view_unresolved": "operator",
     "config.execution_env_capability_invalid": "operator",
     "config.tool_card_undeclared": "operator",
     "config.tool_face_undeclared": "operator",
@@ -155,6 +158,9 @@ export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "route.base_url_changed_key_unchanged": "operator",
     "route.response_model_mismatch": "operator",
     "route.tool_call_id_folded": "operator",
+    "route.finish_reason_unknown": "user",
+    "route.stream_end_ignored": "user",
+    "route.extra_body_reserved_dropped": "operator",
     "context.tool_turn_repaired": "operator",
     "task.user_steer_undrained": "user",
     "task.user_followup_undrained": "user",
@@ -198,7 +204,7 @@ export const CORE_NOTICE_MINTER = Object.freeze({
     "config.artifact_host_invalid": "engine",
     "config.task_root_not_canonical": "engine",
     "config.write_protection_target_view_absent": "engine",
-    "config.write_protection_unresolved": "engine",
+    "config.path_view_unresolved": "engine",
     "config.execution_env_capability_invalid": "engine",
     "config.tool_card_undeclared": "engine",
     "config.tool_face_undeclared": "engine",
@@ -250,6 +256,9 @@ export const CORE_NOTICE_MINTER = Object.freeze({
     "route.base_url_changed_key_unchanged": "engine",
     "route.response_model_mismatch": "engine",
     "route.tool_call_id_folded": "engine",
+    "route.finish_reason_unknown": "engine",
+    "route.stream_end_ignored": "engine",
+    "route.extra_body_reserved_dropped": "engine",
     "context.tool_turn_repaired": "engine",
     "task.user_steer_undrained": "engine",
     "task.user_followup_undrained": "engine",

package/dist/generated/settingsSchemaFns.d.ts

@@ -5,6 +5,9 @@ export type SettingsAtMention = {
     readonly mode: 'only';
     readonly models: readonly string[];
 };
+export type SettingsHookMatcherForm = "literal" | "regex" | "invalid";
 export declare const SETTINGS_IS_LOOPBACK_AUTH_HOST: (host: string) => boolean;
 export declare const SETTINGS_IS_HIERARCHICAL_URL: (raw: string) => boolean;
 export declare const SETTINGS_NARROW_AT_MENTION: (atMention: SettingsAtMention, available: ReadonlySet<string>) => SettingsAtMention;
+export declare const SETTINGS_HOOK_MATCHER_SELECTS: (matcher: string | undefined, name: string) => boolean | 'invalid';
+export declare const SETTINGS_HOOK_MATCHER_FORM: (matcher: string | undefined) => SettingsHookMatcherForm;

package/dist/generated/settingsSchemaFns.js

@@ -20,3 +20,56 @@ export const SETTINGS_NARROW_AT_MENTION = function narrowAtMention(atMention, av
         return atMention;
     return kept.length > 0 ? { mode: "only", models: kept } : { mode: "none" };
 };
+const HOOK_MATCHER_NAME_LIST = /^[a-zA-Z0-9_|, -]+$/;
+const readHookMatcher = function readHookMatcher(matcher) {
+    if (matcher === undefined || matcher === "" || matcher === "*")
+        return { form: "all" };
+    if (HOOK_MATCHER_NAME_LIST.test(matcher)) {
+        return {
+            form: "names",
+            names: matcher
+                .split(/[|,]/)
+                .map((part) => part.trim())
+                .filter((part) => part !== ""),
+        };
+    }
+    try {
+        return { form: "regex", pattern: new RegExp(matcher) };
+    }
+    catch {
+        return { form: "invalid" };
+    }
+};
+export const SETTINGS_HOOK_MATCHER_SELECTS = function hookMatcherSelects(matcher, name) {
+    const r = readHookMatcher(matcher);
+    switch (r.form) {
+        case "all":
+            return true;
+        case "names":
+            return r.names.includes(name);
+        case "regex":
+            return r.pattern.test(name);
+        case "invalid":
+            return "invalid";
+        default: {
+            const unhandled = r;
+            throw new Error(`hookMatcherSelects: unhandled matcher reading ${JSON.stringify(unhandled)}`);
+        }
+    }
+};
+export const SETTINGS_HOOK_MATCHER_FORM = function hookMatcherForm(matcher) {
+    const r = readHookMatcher(matcher);
+    switch (r.form) {
+        case "all":
+        case "names":
+            return "literal";
+        case "regex":
+            return "regex";
+        case "invalid":
+            return "invalid";
+        default: {
+            const unhandled = r;
+            throw new Error(`hookMatcherForm: unhandled matcher reading ${JSON.stringify(unhandled)}`);
+        }
+    }
+};

package/dist/generated/toolNameTables.d.ts

@@ -1,2 +1,3 @@
 export declare const CORE_PROTOCOL_PREFIXES: readonly ["mcp__", "a2a__"];
 export declare const CORE_RETIRED_TOOL_CURRENT_NAMES: ReadonlyMap<string, string | null>;
+export declare const CORE_SKILL_TOOL_NAME: "Skill";

package/dist/generated/toolNameTables.js

@@ -41,3 +41,4 @@ export const CORE_RETIRED_TOOL_CURRENT_NAMES = new Map([
     ["Recall", null],
     ["recall", null],
 ]);
+export const CORE_SKILL_TOOL_NAME = "Skill";

package/dist/hitl/approvalEndingCause.d.ts

@@ -2,4 +2,6 @@ import type { ApprovalSettleCause, AskRowEndingCause } from '@sema-agent/sdk';
 export declare const ASK_ROW_ENDING_CAUSE_WORDS: readonly ["routing_failure_fail_closed", "run_cancelled", "run_exited", "batch_aborted", "batch_sibling_withdrawn", "batch_bound_elsewhere", "adhoc_leg_no_durable_domain", "orphan_ttl_exceeded", "crashed_before_park", "shutdown_before_park"];
 export declare function askRowEndingCauseFor(state: 'VOID' | 'DENIED' | undefined, word: unknown): AskRowEndingCause | undefined;
 export declare function approvalCompleteCauseOf(frame: unknown): ApprovalSettleCause | undefined;
+export declare function notPendingCauseReading(err: object): 'ended' | 'other_replica' | 'none';
+export declare function refusalCauseWordOf(err: object): string | undefined;
 export declare function notPendingCauseSaysEnded(err: object): boolean;

package/dist/hitl/approvalEndingCause.js

@@ -1,5 +1,6 @@
 import { ASK_GONE_DENIED_WORD } from '../engineErrorCodes.js';
 import { SDK_ASK_ROW_ENDING_CAUSES } from '../generated/sdkFactTables.js';
+import { readThrownExtra } from '../wireFailureShape.js';
 export const ASK_ROW_ENDING_CAUSE_WORDS = SDK_ASK_ROW_ENDING_CAUSES;
 const _askRowCausePin = true;
 void _askRowCausePin;
@@ -25,37 +26,46 @@ export function askRowEndingCauseFor(state, word) {
         return word !== DENIED_GROUP_WORD ? word : undefined;
     return undefined;
 }
+function ownDataSlot(o, key) {
+    try {
+        const slot = Object.getOwnPropertyDescriptor(o, key);
+        return slot !== undefined && Object.hasOwn(slot, 'value') ? slot.value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 export function approvalCompleteCauseOf(frame) {
     try {
         if (typeof frame !== 'object' || frame === null)
             return undefined;
-        const typeSlot = Object.getOwnPropertyDescriptor(frame, 'type');
-        if (typeSlot === undefined || !Object.hasOwn(typeSlot, 'value') || typeSlot.value !== 'tool_approval_complete')
+        if (ownDataSlot(frame, 'type') !== 'tool_approval_complete')
             return undefined;
-        const causeSlot = Object.getOwnPropertyDescriptor(frame, 'cause');
-        if (causeSlot === undefined || !Object.hasOwn(causeSlot, 'value'))
-            return undefined;
-        const word = causeSlot.value;
+        const word = ownDataSlot(frame, 'cause');
         return isApprovalSettleCause(word) ? word : undefined;
     }
     catch {
         return undefined;
     }
 }
-const LEGACY_NOT_PENDING_ENDED_WORDS = new Set(['voided', 'denied']);
+const NOT_PENDING_OTHER_REPLICA_WORDS = Object.freeze({
+    unknown_or_other_replica: true,
+});
+export function notPendingCauseReading(err) {
+    const word = refusalCauseWordOf(err);
+    if (word === undefined)
+        return 'none';
+    if (isAskRowEndingCause(word))
+        return 'ended';
+    return Object.hasOwn(NOT_PENDING_OTHER_REPLICA_WORDS, word) ? 'other_replica' : 'none';
+}
+export function refusalCauseWordOf(err) {
+    const reading = readThrownExtra(err);
+    if (reading.state !== 'object')
+        return undefined;
+    const word = ownDataSlot(reading.value, 'cause');
+    return typeof word === 'string' && word !== '' ? word : undefined;
+}
 export function notPendingCauseSaysEnded(err) {
-    try {
-        const extraSlot = Object.getOwnPropertyDescriptor(err, 'extra');
-        const extra = extraSlot !== undefined && Object.hasOwn(extraSlot, 'value') ? extraSlot.value : undefined;
-        if (typeof extra !== 'object' || extra === null || Array.isArray(extra))
-            return false;
-        const causeSlot = Object.getOwnPropertyDescriptor(extra, 'cause');
-        if (causeSlot === undefined || !Object.hasOwn(causeSlot, 'value'))
-            return false;
-        const word = causeSlot.value;
-        return isAskRowEndingCause(word) || (typeof word === 'string' && LEGACY_NOT_PENDING_ENDED_WORDS.has(word));
-    }
-    catch {
-        return false;
-    }
+    return notPendingCauseReading(err) === 'ended';
 }

package/dist/hitl/askParkRowRouting.js

@@ -50,7 +50,7 @@ export function askParkRowArm(row) {
     const rowHasToolName = typeof row.toolName === 'string' && row.toolName.trim().length > 0;
     return askQuestionsFromPending(row) !== null || !rowHasToolName ? 'question' : 'tool-gate';
 }
-const GENERIC_DECISION_GATE_KINDS = ['human', 'policy_ask'];
+const GENERIC_DECISION_GATE_KINDS = ['human'];
 export function askParkRowStillPending(rows, identity) {
     return rows.some(r => identity.gatedCallId !== undefined
         ? (r.toolCallId ?? r.boundCallId ?? undefined) === identity.gatedCallId

package/dist/hitl/automaticAnswerVerdict.d.ts

@@ -19,7 +19,7 @@ export type AutomaticAnswerVerdict = {
     readonly kind: 'unknown';
     readonly why: AutomaticAnswerUnknownWhy;
 };
-export declare const MODE_ARBITRATION: Readonly<Record<"hook" | "write_protection" | "mode" | "rule_unreadable" | "write_protection_unresolved" | "content_question" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "org_rule" | "governance_unavailable" | "ask_rule" | "denial_limit_fallback" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", CoreModeArbitrationRow>>;
+export declare const MODE_ARBITRATION: Readonly<Record<"hook" | "write_protection" | "mode" | "rule_unreadable" | "target_unresolved" | "content_question" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "org_rule" | "governance_unavailable" | "ask_rule" | "denial_limit_fallback" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", CoreModeArbitrationRow>>;
 export declare function foldModeArbitrationRow(classes: Iterable<string>, askFace?: AutomaticAnswerAskFace): CoreModeArbitrationRow;
 export declare function automaticAnswerVerdict(card: object | null | undefined, lane: AutomaticAnswerLane, facts?: AutomaticAnswerFacts | null): AutomaticAnswerVerdict;
 export declare function mandatedApprovalDetailOf(card: object | null | undefined): string;

package/dist/hitl/automaticAnswerVerdict.js

@@ -3,6 +3,7 @@ import { CORE_RELEASABLE_ASK_CLASSES_BY_FACE, CORE_SHELL_FACE_TOOL_NAMES } from
 import { mandatedApprovalDetail } from '../gateVocabulary.js';
 import { readAskOrigin, readOwnNonEmptyString } from '../ownKey.js';
 import { readAskClassPairState } from './askClassPair.js';
+import { currentEngineWord } from '../engineWordRenames.js';
 import { approvalAllowRuleShadowed } from './allowRuleShadow.js';
 import { approvalIsMandated, readApprovalMandate } from './toolApprovalWire.js';
 export const MODE_ARBITRATION = CORE_MODE_ARBITRATION;
@@ -15,9 +16,10 @@ const ORIGIN_IMPLIES_CLASS = Object.freeze({
     ask_rule: 'ask_rule',
     denial_limit_fallback: 'denial_limit_fallback',
 });
-function mandateWordClass(word) {
-    if (word === 'operator_always')
+function mandateWordClass(raw) {
+    if (raw === 'operator_always')
         return 'shell_floor';
+    const word = currentEngineWord(raw);
     return Object.hasOwn(TABLE, word) ? word : undefined;
 }
 const ORDINARY_ROW = CORE_MODE_ARBITRATION.ordinary;
@@ -41,7 +43,8 @@ export function foldModeArbitrationRow(classes, askFace) {
     let sandboxAdmission = true;
     let ruleMayClear = true;
     let hookAskFloor = false;
-    for (const c of classes) {
+    for (const raw of classes) {
+        const c = typeof raw === 'string' ? currentEngineWord(raw) : raw;
         if (!Object.hasOwn(TABLE, c))
             continue;
         const row = TABLE[c];
@@ -130,11 +133,12 @@ export function automaticAnswerVerdict(card, lane, facts) {
             return UNKNOWN.classes_malformed;
         if (pair.state === 'absent')
             return UNKNOWN.classes_absent;
-        const folded = foldModeArbitrationRow(pair.classes, face);
+        const classes = pair.classes.map(currentEngineWord);
+        const folded = foldModeArbitrationRow(classes, face);
         let anyKnown = false;
         let firstBlocking;
         let anyUnknown = false;
-        for (const c of pair.classes) {
+        for (const c of classes) {
             if (!Object.hasOwn(TABLE, c)) {
                 anyUnknown = true;
                 continue;
@@ -154,7 +158,7 @@ export function automaticAnswerVerdict(card, lane, facts) {
             return mustAsk('settings_ask_rule');
         if (matched !== false)
             return UNKNOWN.host_not_reported;
-        const releaseReason = CORE_MODE_RELEASE_REASONS.find((r) => pair.classes.includes(r));
+        const releaseReason = CORE_MODE_RELEASE_REASONS.find((r) => classes.includes(r));
         return releaseReason !== undefined ? Object.freeze({ kind: 'may_answer', releaseReason }) : MAY_ANSWER;
     }
     catch {
@@ -168,9 +172,10 @@ export function mandatedApprovalDetailOf(card) {
         const pair = readAskClassPairState(card);
         if (pair.state !== 'pair')
             return mandatedApprovalDetail();
-        if (pair.classes.some((c) => !Object.hasOwn(TABLE, c)))
+        const classes = pair.classes.map(currentEngineWord);
+        if (classes.some((c) => !Object.hasOwn(TABLE, c)))
             return mandatedApprovalDetail();
-        const row = foldModeArbitrationRow(pair.classes);
+        const row = foldModeArbitrationRow(classes);
         if (row.classifierEligible || row.sandboxAdmission)
             return mandatedApprovalDetail();
         return MANDATED_NO_AUTOMATIC_CHECK_DETAIL;

package/dist/hitl/decisionConflict.js

@@ -34,8 +34,6 @@ export function decisionConflictOf(err) {
     }
     if (code === RESUME_OUTCOME_INVALID)
         return field === ANSWER_FIELD ? 'answer_invalid' : undefined;
-    if (field === ANSWER_FIELD)
-        return 'answer_invalid';
     if (field === undefined)
         return 'row_integrity';
     return BINDING_SEAT_FIELDS.has(field) ? 'binding_mismatch' : undefined;

package/dist/hitl/decisionRefusal.d.ts

@@ -2,6 +2,14 @@ import { type DecisionRefusalConflict } from './decisionConflict.js';
 export type DecisionRefusalStanding = 'settled-elsewhere' | 'ambiguous' | 'refused-pending';
 export type { DecisionRefusalConflict } from './decisionConflict.js';
 export declare function decisionRefusalSaysAskGone(err: unknown): boolean;
+export type DecisionRefusalAskReading = 'settled' | 'not_settled' | 'unreadable';
+interface DecisionRefusalAskFacts {
+    readonly reading: DecisionRefusalAskReading;
+    readonly gateMoved: boolean;
+    readonly wordingHint: boolean;
+}
+export declare function readDecisionRefusalAsk(failure: unknown): DecisionRefusalAskFacts;
+export declare function decisionRefusalAskReading(failure: unknown): DecisionRefusalAskReading;
 export interface DecisionRefusalClassified {
     readonly standing: DecisionRefusalStanding;
     readonly status: number;

package/dist/hitl/decisionRefusal.js

@@ -1,5 +1,8 @@
-import { refusalSaysStillPending } from '../engineErrorCodes.js';
-import { notPendingCauseSaysEnded } from './approvalEndingCause.js';
+import { ApprovalStaleError, AskDecidedError, ParkedResumeStartupError } from '@sema-agent/sdk';
+import { ASK_GONE, ASK_GONE_PARKED, isDecideAlreadyResolvedCode, isDecideParkMovedCode, refusalRetriableReading, refusalSaysStillPending } from '../engineErrorCodes.js';
+import { notPendingCauseReading } from './approvalEndingCause.js';
+import { GATE_FAILURE_CODES } from './hitlBridge.js';
+import { isAlreadyResolvedGateReason, isCodeClassifiedGateFailure } from './parkResolver.js';
 import { decisionConflictOf } from './decisionConflict.js';
 import { readLivePendingRows } from './livePendingAsk.js';
 import { readToolApprovalRespondRefusal } from './toolApprovalWire.js';
@@ -7,20 +10,50 @@ const ASK_DECIDED_CODE = 'conflict.ask_decided';
 const TRANSIENT_STATUSES = new Set([408, 425, 429, 502, 503, 504]);
 const DISPLAYABLE_CODE = /^[A-Za-z0-9._:-]{1,64}$/;
 export function decisionRefusalSaysAskGone(err) {
+    return readDecisionRefusalAsk(err).reading === 'settled';
+}
+const facts = (reading, gateMoved = false, wordingHint = false) => ({ reading, gateMoved, wordingHint });
+export function readDecisionRefusalAsk(failure) {
+    if (typeof failure !== 'object' || failure === null)
+        return facts('not_settled');
+    let flattened, localCode, name, errorCode, status, retriable, text;
     try {
-        if (typeof err === 'object' && err !== null && 'code' in err) {
-            const code = err.code;
-            if (code === 'no_pending')
-                return true;
-        }
-        const c = classifyDecisionRefusal(err);
-        if (c?.standing !== 'settled-elsewhere')
-            return false;
-        return c.status !== 404 || (typeof err === 'object' && err !== null && notPendingCauseSaysEnded(err));
+        const o = failure;
+        if (Object.hasOwn(failure, 'unreadable') && failure.unreadable === true)
+            return facts('unreadable');
+        flattened = Object.hasOwn(failure, 'kind') && o.kind === 'failed';
+        const closed = (v) => (typeof v === 'string' && GATE_FAILURE_CODES.includes(v) ? v : undefined);
+        localCode = flattened ? (closed(o.code) ?? closed(o.safetyCode)) : closed(o.code);
+        name = flattened ? undefined : o.name;
+        errorCode = o.errorCode;
+        status = o.status;
+        retriable = refusalRetriableReading(failure);
+        text = flattened ? o.reason : String(failure);
     }
     catch {
-        return false;
+        return facts('unreadable');
     }
+    if (retriable === undefined)
+        return facts('unreadable');
+    if (localCode !== undefined)
+        return facts(localCode === 'no_pending' ? 'settled' : 'not_settled');
+    if (name === 'HitlSafetyError')
+        return facts('not_settled');
+    const code = typeof errorCode === 'string' && errorCode.length > 0 ? errorCode : undefined;
+    const st = typeof status === 'number' && Number.isInteger(status) && status >= 400 && status <= 599 ? status : undefined;
+    if (code === ASK_DECIDED_CODE || code === ASK_GONE || (st === 410 && code !== ASK_GONE_PARKED))
+        return facts('settled');
+    if (st === 404 && notPendingCauseReading(failure) === 'ended')
+        return facts('settled');
+    if (code === undefined && name === AskDecidedError.name)
+        return facts('settled');
+    const gateMoved = isDecideAlreadyResolvedCode(code) || isDecideParkMovedCode(code) || code === ASK_GONE_PARKED || (code === undefined && name === ApprovalStaleError.name);
+    if (gateMoved || st !== undefined || name === ParkedResumeStartupError.name || isCodeClassifiedGateFailure(code, retriable))
+        return facts('not_settled', gateMoved);
+    return facts('not_settled', false, isAlreadyResolvedGateReason(text));
+}
+export function decisionRefusalAskReading(failure) {
+    return readDecisionRefusalAsk(failure).reading;
 }
 export function classifyDecisionRefusal(err) {
     const r = readToolApprovalRespondRefusal(err);
@@ -29,12 +62,13 @@ export function classifyDecisionRefusal(err) {
         return undefined;
     const code = r?.errorCode;
     const errorCode = code !== undefined && DISPLAYABLE_CODE.test(code) ? code : undefined;
-    const standing = status === 404 || status === 410 || (status === 409 && code === ASK_DECIDED_CODE)
+    const standing = readDecisionRefusalAsk(err).reading === 'settled'
         ? 'settled-elsewhere'
         : status >= 500 && status !== 501
             ? 'ambiguous'
             : 'refused-pending';
-    const transient = TRANSIENT_STATUSES.has(status) || (typeof err === 'object' && err !== null && refusalSaysStillPending(err));
+    const transient = TRANSIENT_STATUSES.has(status) ||
+        (typeof err === 'object' && err !== null && (refusalSaysStillPending(err) || (status === 404 && notPendingCauseReading(err) === 'other_replica')));
     const conflict = status === 409 ? decisionConflictOf(err) : undefined;
     return Object.freeze({
         standing,

package/dist/hitl/frameRouter.d.ts

@@ -17,7 +17,6 @@ export interface PolicyDenyReasonFacts {
 export declare function policyDenyReason(facts: PolicyDenyReasonFacts): string;
 export declare const HITL_INTERRUPT_MESSAGE_FOR_TOOL_USE = "[Request interrupted by user for tool use]";
 export declare const ENGINE_ABORT_TOOL_RESULT = "Operation aborted";
-export declare function toolEndOutputText(output: unknown): string | undefined;
 export interface ParkReattachNotice {
     attempt: number;
     max: number;

package/dist/hitl/frameRouter.js

@@ -2,6 +2,7 @@ import { hostLog } from '../host.js';
 import { invokeHostCallbackIsolated } from '../hostCallbackGuard.js';
 import { isToolApprovalGate, toolNameIsFsWrite, toolNameIsShellExec, isToolApprovalFrame, isFromSubagent, surfaceToolApprovalFrameAndRespond, } from './toolApprovalWire.js';
 import { classifierDenyFromToolEnd } from '../classifierVerdictWire.js';
+import { toolEndOutputText } from '../toolResultContent.js';
 import { GATE_PARKED_ERROR_CODE } from '../engineErrorCodes.js';
 import { readRunTerminal, runTerminalCode, runTerminalGateKind, runTerminalGateToolName } from '../runTerminal.js';
 import { surfaceForCurrentSession, surfaceReplayedApprovalListUnreadable } from './hitlHostSurface.js';
@@ -23,7 +24,7 @@ export function policyDenyReason(facts) {
     const one = typeof facts.toolName === 'string' && SENTENCE_TOOL_NAME.test(facts.toolName) ? `this one "${facts.toolName}" call` : 'this one call';
     const flag = typeof facts.allowRuleFlag === 'string' && SENTENCE_TOOL_NAME.test(facts.allowRuleFlag.replace(/^--?/, '')) ? ` (or ${facts.allowRuleFlag})` : '';
     const budgetKnob = typeof facts.budgetSetting === 'string' && SENTENCE_TOOL_NAME.test(facts.budgetSetting) ? facts.budgetSetting : undefined;
-    const cause = facts.cause === 'no_allow_rule' || facts.cause === 'ask_rule' || facts.cause === 'budget' ? facts.cause : 'other';
+    const cause = facts.cause === 'no_allow_rule' || facts.cause === 'ask_rule' || facts.cause === 'engine_ask_rule' || facts.cause === 'budget' ? facts.cause : 'other';
     if (facts.lane === 'dont_ask') {
         const mode = 'denied by the dontAsk permission mode';
         switch (cause) {
@@ -31,6 +32,8 @@ export function policyDenyReason(facts) {
                 return `${mode}: ${one} needed approval, no permission rule allowed it, and this mode refuses anything that would ask — calls that need no approval still run; an allow rule in settings${flag} can approve calls like this ahead of time`;
             case 'ask_rule':
                 return `${mode}: an ask rule matched ${one}, and this mode refuses anything that would ask (an ask rule outranks allow rules) — narrow or remove that ask rule, or use another permission mode to answer it`;
+            case 'engine_ask_rule':
+                return `${mode}: a rule on the engine side, not one of the user's permission rules, asks about ${one}, and this mode refuses anything that would ask — the user's settings cannot approve it; use another permission mode to answer it`;
             case 'budget':
                 return `${mode}: ${one} needed approval, and this session's automatic-approval budget is used up, so saved rules no longer approve calls${budgetKnob !== undefined ? ` — raise ${budgetKnob} before launch to change the cap` : ''}`;
             default:
@@ -44,6 +47,8 @@ export function policyDenyReason(facts) {
             return `${lane}: ${one} needed a person's approval, no permission rule answered it, and ${tail}; a matching allow rule in settings${flag} can approve calls like this ahead of time`;
         case 'ask_rule':
             return `${lane}: an ask rule matched ${one}, so it needed a person's answer, and ${tail}; an ask rule outranks allow rules, so narrow or remove that ask rule, or run the task interactively to answer it`;
+        case 'engine_ask_rule':
+            return `${lane}: a rule on the engine side, not one of the user's permission rules, asks about ${one}, so it needed a person's answer, and ${tail}; the user's settings cannot approve it - run the task interactively to answer it`;
         case 'budget':
             return `${lane}: ${one} needed a person's approval, and this session's automatic-approval budget is used up, so saved rules no longer approve calls; ${tail}${budgetKnob !== undefined ? `; raise ${budgetKnob} before launch to change the cap` : ''}`;
         default:
@@ -73,19 +78,6 @@ function denyStampedEnd(ev, attribution) {
 export const HITL_INTERRUPT_MESSAGE_FOR_TOOL_USE = '[Request interrupted by user for tool use]';
 const RUN_CANCELLED_ERROR_CODE = RUN_CANCELLED_CODE;
 export const ENGINE_ABORT_TOOL_RESULT = 'Operation aborted';
-export function toolEndOutputText(output) {
-    if (typeof output === 'string')
-        return output;
-    if (!Array.isArray(output))
-        return undefined;
-    const parts = [];
-    for (const b of output) {
-        const bb = b;
-        if (bb?.type === 'text' && typeof bb.text === 'string')
-            parts.push(bb.text);
-    }
-    return parts.length > 0 ? parts.join('') : undefined;
-}
 function isAskToolLoose(name) {
     return typeof name === 'string' && name.replace(/[\s_-]+/g, '').toLowerCase() === 'askuserquestion';
 }

package/dist/hitl/hitlBridge.d.ts

@@ -46,7 +46,7 @@ export interface PlanReviewOutcome {
 export declare const PLAN_REVIEW_MODE_AFTER_WORDS: readonly ["default", "acceptEdits"];
 export type PlanReviewModeAfter = (typeof PLAN_REVIEW_MODE_AFTER_WORDS)[number];
 export declare function isPlanReviewModeAfter(v: string | undefined): v is PlanReviewModeAfter;
-export declare const GATE_FAILURE_CODES: readonly ["no_pending", "binding_mismatch", "wrong_gate", "bad_plan_edit", "bad_plan_mode", "empty_answer"];
+export declare const GATE_FAILURE_CODES: readonly ["no_pending", "binding_mismatch", "wrong_gate", "bad_plan_edit", "bad_plan_mode", "empty_answer", "binding_missing"];
 export type HitlSafetyCode = (typeof GATE_FAILURE_CODES)[number];
 export type HitlFailureStage = 'fetch' | 'input' | 'card' | 'decide' | 'orchestration';
 export declare const NO_APPROVAL_CARD_PORT_REASON = "no approval card port installed (print/non-REPL mode, or host forgot installApprovalCardPort)";
@@ -76,6 +76,10 @@ export type WireErrorCodeReading = {
     readonly state: 'unreadable';
 };
 export declare function readWireErrorCodeReading(e: unknown): WireErrorCodeReading;
+export declare function readWireCodes(e: unknown): {
+    readonly errorCode?: string;
+    readonly blockedBy?: string;
+};
 export declare function __setDecideTimeoutRetryBudgetForTests(ms?: number): void;
 export declare class DecideTransportRetryExhaustedError extends Error {
     readonly attempts: number;
@@ -116,7 +120,7 @@ export type FindPendingOutcome = {
 } | {
     ok: false;
     reason: string;
-    code?: 'no_pending';
+    code?: 'no_pending' | 'wrong_gate';
 };
 export declare function findPendingForTask(client: HitlClientLike, taskId: string, matches: (toolName: string | undefined) => boolean, opts?: {
     signal?: AbortSignal;

package/dist/hitl/hitlBridge.js

@@ -4,8 +4,8 @@ import { hostLog } from '../host.js';
 import { invokeHostCallbackIsolated } from '../hostCallbackGuard.js';
 import { abortableSleep } from '../abortableSleep.js';
 import { readOwnDataValue } from '../ownKey.js';
-import { THROWN_SLOT_UNREADABLE, readThrownSlot, thrownIsInstanceOf, wireFailureTextsOf } from '../wireFailureShape.js';
-import { decisionConflictOf } from './decisionConflict.js';
+import { THROWN_SLOT_UNREADABLE, readBlockedBy, readThrownSlot, thrownIsInstanceOf, wireFailureTextsOf } from '../wireFailureShape.js';
+import { RESUME_POLICY_FOLD_CODE } from '../engineErrorCodes.js';
 import { suspendedReopenOf } from './suspendedReopen.js';
 export const DEFAULT_DENY_REASON = 'The user rejected this tool use';
 const MAX_DENY_REASON_CHARS = 4096;
@@ -29,14 +29,15 @@ export const PLAN_REVIEW_MODE_AFTER_WORDS = Object.freeze(['default', 'acceptEdi
 export function isPlanReviewModeAfter(v) {
     return v !== undefined && PLAN_REVIEW_MODE_AFTER_WORDS.includes(v);
 }
-export const GATE_FAILURE_CODES = [
+export const GATE_FAILURE_CODES = Object.freeze([
     'no_pending',
     'binding_mismatch',
     'wrong_gate',
     'bad_plan_edit',
     'bad_plan_mode',
     'empty_answer',
-];
+    'binding_missing',
+]);
 export const NO_APPROVAL_CARD_PORT_REASON = 'no approval card port installed (print/non-REPL mode, or host forgot installApprovalCardPort)';
 export const APPROVAL_CARD_PORT_KEY_MISMATCH_REASON = 'no approval card port installed for the default session key, but a non-default sessionKey has one — likely a keyed-install/default-read mismatch (installApprovalCardPortFor vs the zero-arg default-key read), not a missing install';
 export const NO_QUESTION_OVERLAY_REASON = 'no question overlay mounted (print/non-REPL mode)';
@@ -92,6 +93,15 @@ export function readWireErrorCodeReading(e) {
         return { state: 'unreadable' };
     return typeof raw === 'string' && raw.length > 0 ? { state: 'code', code: raw } : { state: 'absent' };
 }
+export function readWireCodes(e) {
+    const reading = readWireErrorCodeReading(e);
+    if (reading.state !== 'code')
+        return {};
+    if (reading.code !== RESUME_POLICY_FOLD_CODE)
+        return { errorCode: reading.code };
+    const folded = readBlockedBy(e);
+    return folded.kind === 'named' ? { errorCode: reading.code, blockedBy: folded.code } : { errorCode: reading.code };
+}
 const DECIDE_TRANSPORT_RETRY_BACKOFF_MS = 750;
 const DECIDE_RETRY_BACKOFF_MAX_MS = 5_000;
 const DECIDE_ATTEMPT_TIMEOUT_CAP_MS = 60_000;
@@ -224,10 +234,21 @@ export async function findPendingForTask(client, taskId, matches, opts, callId,
         hostLog('debug', `hitlBridge: approvals.list failed: ${t.log}`);
         return { ok: false, reason: `approvals.list failed: ${t.reason}` };
     }
-    const decidable = rows.filter((r) => askParkForeignGateKind(r) === null);
+    const readings = rows.map((r) => ({ r, foreign: askParkForeignGateKind(r) }));
+    const decidable = readings.filter((x) => x.foreign === null).map((x) => x.r);
     const identityRow = callId !== undefined
         ? decidable.find((r) => r.taskId === taskId && (r.boundCallId === callId || r.toolCallId === callId))
         : undefined;
+    const identityForeign = callId !== undefined && identityRow === undefined
+        ? readings.find((x) => x.r.taskId === taskId && (x.r.boundCallId === callId || x.r.toolCallId === callId) && x.foreign !== null)
+        : undefined;
+    if (identityForeign !== undefined) {
+        return {
+            ok: false,
+            reason: `the pending row this park names (call ${callId}) is parked on a '${String(identityForeign.foreign)}' gate — not an approval this leg decides; refusing to decide a different row`,
+            code: 'wrong_gate',
+        };
+    }
     const identityConflicts = identityRow !== undefined && !identityAccepts(identityRow);
     const pool = identityConflicts ? decidable.filter((r) => identityAccepts(r)) : decidable;
     const pending = (identityConflicts ? undefined : identityRow) ??
@@ -286,7 +307,7 @@ export class HitlBridge {
         if (p.boundCallId === undefined || p.boundInputHash === undefined) {
             throw new HitlSafetyError(`pending checkpoint ${p.id ?? '<no-id>'} is missing D-1 binding fields ` +
                 `(boundCallId=${String(p.boundCallId)}, boundInputHash=${String(p.boundInputHash)}) — ` +
-                'pre-D-1 workers are no longer supported (server 5.x requires the verbatim two-tuple echo)', 'binding_mismatch');
+                'pre-D-1 workers are no longer supported (server 5.x requires the verbatim two-tuple echo)', 'binding_missing');
         }
         return { boundCallId: p.boundCallId, boundInputHash: p.boundInputHash };
     }
@@ -500,7 +521,7 @@ function bindingMismatchReading(e) {
     const name = readThrownSlot(e, 'name');
     const family = (code.state === 'code' && code.code === 'approval_binding_mismatch') || name === 'ApprovalBindingMismatchError';
     if (family)
-        return decisionConflictOf(e) !== 'answer_invalid' ? 'mismatch' : 'not';
+        return 'mismatch';
     if (code.state === 'unreadable')
         return 'unreadable';
     return 'not';

package/dist/hitl/localAllowRule.d.ts

@@ -6,6 +6,7 @@ export interface LocalAllowRuleDeps {
     bashRuleContentHasDangerousBarePrefix(ruleContent: string): boolean;
     isDangerousBashPermission(toolName: string, ruleContent: string): boolean;
     isDangerousPowerShellPermission(toolName: string, ruleContent: string): boolean;
+    onFailure?(log: string): void;
 }
 export type LocalAllowRuleParse = {
     ok: true;

package/dist/hitl/localAllowRule.js

@@ -1,4 +1,4 @@
-import { wireFailureTextsOf } from '../wireFailureShape.js';
+import { reasonOfThrownWithSink } from '../hostCallbackGuard.js';
 const BASH_TOOL_NAME_FOR_RULES = 'Bash';
 export function parseLocalAllowRule(rule, expectedToolName, deps) {
     if (typeof rule !== 'string' || rule === '') {
@@ -9,7 +9,7 @@ export function parseLocalAllowRule(rule, expectedToolName, deps) {
         value = deps.parseRule(rule);
     }
     catch (e) {
-        return { ok: false, error: `rule text did not parse (${wireFailureTextsOf(e).reason})` };
+        return { ok: false, error: `rule text did not parse (${reasonOfThrownWithSink(e, (log) => deps.onFailure?.(log))})` };
     }
     if (typeof value.toolName !== 'string' || value.toolName === '') {
         return { ok: false, error: 'rule text carries no tool name' };