@sema-agent/client-core 0.95.0 → 0.97.0

package/dist/gateOutcome.js

@@ -1,7 +1,7 @@
 import { ccToolDenialKindForSettledBy, isCcToolDenialKind, isGateDeniedByWord } from './gateVocabulary.js';
 import { GATE_PARKED_ERROR_CODE } from './engineErrorCodes.js';
 import { CORE_MODE_RELEASE_REASONS, CORE_SETTLEMENT_KINDS } from './generated/engineFactTables.js';
-import { readAskOrigin } from './ownKey.js';
+import { readAskOrigin, readOwnDataNonEmptyString, readOwnDataValue } from './ownKey.js';
 function str(v) {
     return typeof v === 'string' && v.length > 0 ? v : undefined;
 }
@@ -9,6 +9,61 @@ export const GATE_MODE_RELEASE_REASON_WORDS = CORE_MODE_RELEASE_REASONS;
 export function isGateModeReleaseReasonWord(v) {
     return typeof v === 'string' && CORE_MODE_RELEASE_REASONS.includes(v);
 }
+const MODE_RELEASE_SENTENCE_BY_REASON = Object.freeze({
+    rule_unreadable: 'The permission mode let this call run without asking, even though it could not be checked against your saved permission rules.',
+    target_unresolved: 'The permission mode let this call run without asking, even though it could not be determined where its write lands on disk, so whether it lands on a guarded location is unknown.',
+});
+const MODE_RELEASE_UNRECOGNISED_SENTENCE = 'The permission mode let this call run without asking, for a reason this client does not recognise.';
+export function modeReleaseReasonSentence(reason) {
+    try {
+        if (typeof reason !== 'string' || reason === '')
+            return undefined;
+        return Object.hasOwn(MODE_RELEASE_SENTENCE_BY_REASON, reason)
+            ? MODE_RELEASE_SENTENCE_BY_REASON[reason]
+            : MODE_RELEASE_UNRECOGNISED_SENTENCE;
+    }
+    catch {
+        return undefined;
+    }
+}
+const RELEASE_DISCLOSURE_LEDGER_MAX = 256;
+function releaseDisclosureKeyOf(identity) {
+    try {
+        if (typeof identity !== 'object' || identity === null)
+            return undefined;
+        const callId = readOwnDataNonEmptyString(identity, 'toolCallId');
+        if (callId !== undefined) {
+            const epoch = readOwnDataValue(identity, 'epoch');
+            const scope = typeof epoch === 'string' ? epoch : typeof epoch === 'number' && Number.isFinite(epoch) ? String(epoch) : '';
+            return JSON.stringify(['call', scope, callId]);
+        }
+        const cardKey = readOwnDataNonEmptyString(identity, 'callKey');
+        return cardKey !== undefined ? JSON.stringify(['card', cardKey]) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function createReleaseDisclosureLedger() {
+    const said = new Set();
+    return Object.freeze({
+        has(identity) {
+            const key = releaseDisclosureKeyOf(identity);
+            return key !== undefined && said.has(key);
+        },
+        mark(identity) {
+            const key = releaseDisclosureKeyOf(identity);
+            if (key === undefined || said.has(key))
+                return;
+            said.add(key);
+            if (said.size > RELEASE_DISCLOSURE_LEDGER_MAX) {
+                const oldest = said.values().next();
+                if (oldest.done !== true)
+                    said.delete(oldest.value);
+            }
+        },
+    });
+}
 export const SETTLEMENT_KIND_WORDS = CORE_SETTLEMENT_KINDS;
 function readWho(v) {
     if (typeof v !== 'object' || v === null || Array.isArray(v))

package/dist/gateVocabulary.d.ts

@@ -1,5 +1,4 @@
-import { CORE_DENIED_BY_VALUES } from './generated/engineFactTables.js';
-import type { APPROVAL_MANDATE_WORDS } from './hitl/toolApprovalWire.js';
+import { CORE_DENIED_BY_VALUES, CORE_PERSISTED_RULE_MANDATES } from './generated/engineFactTables.js';
 export declare const CC_TOOL_DENIAL_KINDS: readonly ["user-rejected", "permission-rule", "automode-blocked", "automode-unavailable", "automode-parsing-error", "interrupted", "cancelled"];
 export type CcToolDenialKind = (typeof CC_TOOL_DENIAL_KINDS)[number];
 export declare function isCcToolDenialKind(v: unknown): v is CcToolDenialKind;
@@ -11,6 +10,7 @@ export declare function isGateDeniedByWord(v: unknown): v is GateDeniedByWord;
 export declare function gateDeniedByDetail(deniedBy: unknown): string;
 export declare function askOriginDetail(origin: unknown): string;
 export declare function mandatedApprovalDetail(): string;
+export declare const APPROVAL_MANDATE_WORDS: readonly (typeof CORE_PERSISTED_RULE_MANDATES)[number][];
 export type ApprovalMandateWord = (typeof APPROVAL_MANDATE_WORDS)[number];
 export declare function isApprovalMandateWord(v: unknown): v is ApprovalMandateWord;
 export declare function approvalMandateDetail(word: ApprovalMandateWord): string;

package/dist/gateVocabulary.js

@@ -1,4 +1,4 @@
-import { CORE_DENIED_BY_VALUES } from './generated/engineFactTables.js';
+import { CORE_DENIED_BY_VALUES, CORE_PERSISTED_RULE_MANDATES } from './generated/engineFactTables.js';
 export const CC_TOOL_DENIAL_KINDS = Object.freeze([
     'user-rejected',
     'permission-rule',
@@ -71,6 +71,7 @@ export function askOriginDetail(origin) {
 export function mandatedApprovalDetail() {
     return 'no saved allow rule and no remembered answer can retire this question; each call is settled on its own — by you here or by an automatic check the deployment runs — and an answer covers only that call';
 }
+export const APPROVAL_MANDATE_WORDS = Object.freeze([...CORE_PERSISTED_RULE_MANDATES]);
 const _mandateWordsPin = true;
 void _mandateWordsPin;
 export function isApprovalMandateWord(v) {
@@ -82,9 +83,9 @@ const APPROVAL_MANDATE_SENTENCES = Object.freeze({
     probe_mandate: 'the check run on this call marked it as needing its own confirmation (the built-in shell check does so for a read outside the directories allowed for this session)',
     probe_unanswered: 'the check run on this call did not answer (it timed out or failed; this client cannot tell which), so whether the call stays inside the directories allowed for this session is unknown',
     write_protection: "this change lands on a protected location (the agent's own configuration), which is confirmed one change at a time",
-    write_protection_unresolved: 'the protected-location check could not tell where this change lands, so whether it touches a protected location is unknown',
+    target_unresolved: 'where this change lands on disk could not be determined (a link on the way could not be examined, or the target could not be resolved), so whether it lands on a guarded location is unknown',
 });
-const APPROVAL_MANDATE_SET = new Set(Object.keys(APPROVAL_MANDATE_SENTENCES));
+const APPROVAL_MANDATE_SET = new Set(APPROVAL_MANDATE_WORDS);
 export function approvalMandateDetail(word) {
     if (typeof word === 'string' && Object.hasOwn(APPROVAL_MANDATE_SENTENCES, word)) {
         return APPROVAL_MANDATE_SENTENCES[word];

package/dist/generated/engineAskFaceTables.js

@@ -7,6 +7,6 @@ export const CORE_SHELL_FACE_TOOL_NAMES = Object.freeze([
     "Monitor",
 ]);
 export const CORE_RELEASABLE_ASK_CLASSES_BY_FACE = Object.freeze({
-    "shell": Object.freeze(["transcript_write", "rule_unreadable", "write_protection_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "artifact_shared_read", "mode", "unstated", "ordinary"]),
+    "shell": Object.freeze(["transcript_write", "rule_unreadable", "target_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "artifact_shared_read", "mode", "unstated", "ordinary"]),
     "other": Object.freeze(["transcript_write", "rule_unreadable", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "artifact_shared_read", "mode", "unstated", "ordinary"]),
 });

package/dist/generated/engineFactTables.d.ts

@@ -8,7 +8,7 @@ export declare const CORE_DENIED_BY_VALUES: readonly ["policy", "hook", "org", "
 export declare const CORE_PERMISSION_MODE_FOLD_REASONS: readonly string[];
 export declare const CORE_ENGINE_CARD_TYPES: readonly string[];
 export declare const CORE_TOOL_DECLARATION_CODES: readonly string[];
-export declare const CORE_MODE_RELEASE_REASONS: readonly ["rule_unreadable", "write_protection_unresolved"];
+export declare const CORE_MODE_RELEASE_REASONS: readonly ["rule_unreadable", "target_unresolved"];
 export declare const CORE_HOOK_TOOL_ALIASES: Readonly<Record<string, string>>;
 export declare const CORE_ASK_EVIDENCE_ABSENCE_VALUES: readonly ["not_wired", "not_adjudicated", "unavailable", "no_match", "not_reported"];
 export declare const CORE_SYSTEM_INJECTION_PRIORITIES: readonly ["now", "next", "later"];
@@ -21,9 +21,9 @@ export interface CoreModeArbitrationRow {
     readonly ruleMayClear: boolean;
     readonly hookAskFloor: boolean;
 }
-export declare const CORE_MODE_ARBITRATION: Readonly<Record<"content_question" | "hook" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "transcript_write" | "org_rule" | "governance_unavailable" | "rule_unreadable" | "ask_rule" | "denial_limit_fallback" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "write_protection_unresolved" | "probe" | "write_protection" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "mode" | "unstated" | "ordinary", CoreModeArbitrationRow>>;
+export declare const CORE_MODE_ARBITRATION: Readonly<Record<"content_question" | "hook" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "org_rule" | "governance_unavailable" | "rule_unreadable" | "ask_rule" | "denial_limit_fallback" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "target_unresolved" | "probe" | "write_protection" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "mode" | "unstated" | "ordinary", CoreModeArbitrationRow>>;
 export declare const CORE_SKILL_GRANT_ORIGINS: readonly ["model", "user", "inherited"];
-export declare const CORE_ALLOW_ENTRY_INERT_REASONS: readonly ["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar", "tool_name", "near_miss"];
+export declare const CORE_ALLOW_ENTRY_INERT_REASONS: readonly ["wildcard_all", "namespace_wildcard", "content_unsupported", "grammar", "tool_name", "near_miss"];
 export declare const CORE_ALLOW_RULE_MEMBERS: readonly ["hook", "deployment", "persisted", "skill", "request"];
 export declare const CORE_RULE_TOOL_NAME_VERDICTS: readonly ["current", "retired", "unprefixed_namespace", "unmintable_segment"];
 export declare const CORE_SETTLEMENT_KINDS: readonly ["human_allowed", "human_refused", "approval_window_expired", "denial_limit_window_expired", "park_sla_expired", "no_approver", "approver_unavailable", "approver_error", "approver_contract", "presentation_failed", "blanket_allow_refused", "policy_allowed", "policy_refused", "task_aborted"];
@@ -32,6 +32,7 @@ export declare const CORE_AUTO_MODE_UNAVAILABLE_CAUSES: readonly ["error", "time
 export declare const CORE_DEFAULT_TIER_ORDER: readonly ["ultra", "max", "pro", "flash", "lite"];
 export declare const CORE_CC_MODEL_TIER_ALIASES: Readonly<Record<"fable" | "mythos" | "opus" | "sonnet" | "haiku", (typeof CORE_DEFAULT_TIER_ORDER)[number]>>;
 export declare const CORE_DURABLE_AGENT_HANDLE_RE: RegExp;
+export declare const CORE_TASK_HANDLE_PREFIXES: Readonly<Record<"background_bash" | "workflow" | "background_agent" | "monitor", string>>;
 export declare const CORE_PERMISSION_MODE_CLASSES: readonly ["bypass", "prompting"];
 export declare const CORE_MCP_LIVENESS_STATES: readonly ["reachable", "unreachable", "unknown"];
 export declare const CORE_RULE_BEHAVIORS: readonly ["deny", "ask", "allow"];
@@ -40,3 +41,4 @@ export declare const CORE_MAX_PENDING_STEER_CHARS: number;
 export declare const CORE_PROMPT_BLOCK_CAUSES: readonly ["block", "crashed", "timeout", "cancelled"];
 export declare const CORE_PERMISSION_MODES: readonly ["default", "acceptEdits", "plan", "auto", "bypassPermissions", "dontAsk"];
 export declare const CORE_APPROVAL_REACH: readonly ["none"];
+export declare const CORE_PERSISTED_RULE_MANDATES: readonly ["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "target_unresolved"];

package/dist/generated/engineFactTables.js

@@ -113,7 +113,7 @@ export const CORE_TOOL_DECLARATION_CODES = Object.freeze([
 ]);
 export const CORE_MODE_RELEASE_REASONS = Object.freeze([
     "rule_unreadable",
-    "write_protection_unresolved",
+    "target_unresolved",
 ]);
 export const CORE_HOOK_TOOL_ALIASES = Object.freeze(Object.assign(Object.create(null), Object.fromEntries([
     ["ListPeers", "ListAgents"],
@@ -147,6 +147,7 @@ export const CORE_MODE_ARBITRATION = Object.freeze({
     "ancestor": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
     "dangerous_delete": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true }),
     "unverifiable_delete": Object.freeze({ bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true }),
+    "unverifiable_shell_text": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true }),
     "transcript_write": Object.freeze({ bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true }),
     "org_rule": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
     "governance_unavailable": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
@@ -157,7 +158,7 @@ export const CORE_MODE_ARBITRATION = Object.freeze({
     "requires_user_interaction": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true }),
     "operator_forced": Object.freeze({ bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false }),
     "shell_floor": Object.freeze({ bypassImmune: true, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false }),
-    "write_protection_unresolved": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: true }),
+    "target_unresolved": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: true }),
     "probe": Object.freeze({ bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
     "write_protection": Object.freeze({ bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: true }),
     "tool_marks_mcp": Object.freeze({ bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: false, hookAskFloor: false }),
@@ -176,8 +177,6 @@ export const CORE_SKILL_GRANT_ORIGINS = Object.freeze([
 export const CORE_ALLOW_ENTRY_INERT_REASONS = Object.freeze([
     "wildcard_all",
     "namespace_wildcard",
-    "path_pattern",
-    "domain",
     "content_unsupported",
     "grammar",
     "tool_name",
@@ -235,6 +234,12 @@ export const CORE_CC_MODEL_TIER_ALIASES = Object.freeze({
     "haiku": "lite",
 });
 export const CORE_DURABLE_AGENT_HANDLE_RE = Object.freeze(/^a[0-9a-f]{6,32}$/);
+export const CORE_TASK_HANDLE_PREFIXES = Object.freeze({
+    "background_bash": "b",
+    "workflow": "w",
+    "background_agent": "a",
+    "monitor": "m",
+});
 export const CORE_PERMISSION_MODE_CLASSES = Object.freeze([
     "bypass",
     "prompting",
@@ -268,3 +273,11 @@ export const CORE_PERMISSION_MODES = Object.freeze([
 export const CORE_APPROVAL_REACH = Object.freeze([
     "none",
 ]);
+export const CORE_PERSISTED_RULE_MANDATES = Object.freeze([
+    "operator_always",
+    "tool_marks",
+    "probe_mandate",
+    "probe_unanswered",
+    "write_protection",
+    "target_unresolved",
+]);

package/dist/generated/engineNoticeTables.js

@@ -14,7 +14,7 @@ export const CORE_ENGINE_NOTICE_CODES = Object.freeze([
     "config.artifact_host_invalid",
     "config.task_root_not_canonical",
     "config.write_protection_target_view_absent",
-    "config.write_protection_unresolved",
+    "config.path_view_unresolved",
     "config.execution_env_capability_invalid",
     "config.tool_card_undeclared",
     "config.tool_face_undeclared",
@@ -66,6 +66,9 @@ export const CORE_ENGINE_NOTICE_CODES = Object.freeze([
     "route.base_url_changed_key_unchanged",
     "route.response_model_mismatch",
     "route.tool_call_id_folded",
+    "route.finish_reason_unknown",
+    "route.stream_end_ignored",
+    "route.extra_body_reserved_dropped",
     "context.tool_turn_repaired",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
@@ -103,7 +106,7 @@ export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "config.artifact_host_invalid": "operator",
     "config.task_root_not_canonical": "operator",
     "config.write_protection_target_view_absent": "operator",
-    "config.write_protection_unresolved": "operator",
+    "config.path_view_unresolved": "operator",
     "config.execution_env_capability_invalid": "operator",
     "config.tool_card_undeclared": "operator",
     "config.tool_face_undeclared": "operator",
@@ -155,6 +158,9 @@ export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "route.base_url_changed_key_unchanged": "operator",
     "route.response_model_mismatch": "operator",
     "route.tool_call_id_folded": "operator",
+    "route.finish_reason_unknown": "user",
+    "route.stream_end_ignored": "user",
+    "route.extra_body_reserved_dropped": "operator",
     "context.tool_turn_repaired": "operator",
     "task.user_steer_undrained": "user",
     "task.user_followup_undrained": "user",
@@ -198,7 +204,7 @@ export const CORE_NOTICE_MINTER = Object.freeze({
     "config.artifact_host_invalid": "engine",
     "config.task_root_not_canonical": "engine",
     "config.write_protection_target_view_absent": "engine",
-    "config.write_protection_unresolved": "engine",
+    "config.path_view_unresolved": "engine",
     "config.execution_env_capability_invalid": "engine",
     "config.tool_card_undeclared": "engine",
     "config.tool_face_undeclared": "engine",
@@ -250,6 +256,9 @@ export const CORE_NOTICE_MINTER = Object.freeze({
     "route.base_url_changed_key_unchanged": "engine",
     "route.response_model_mismatch": "engine",
     "route.tool_call_id_folded": "engine",
+    "route.finish_reason_unknown": "engine",
+    "route.stream_end_ignored": "engine",
+    "route.extra_body_reserved_dropped": "engine",
     "context.tool_turn_repaired": "engine",
     "task.user_steer_undrained": "engine",
     "task.user_followup_undrained": "engine",

package/dist/generated/sdkFactTables.d.ts

@@ -3,3 +3,5 @@ export declare const SDK_STATUS_DERIVED_COARSE_CODES: readonly ["request.rejecte
 export declare const SDK_DENY_REASON_ROUTING_FAILURE: "routing_failure_fail_closed";
 export declare const SDK_ASK_ROW_ENDING_CAUSES: readonly ["routing_failure_fail_closed", "run_cancelled", "run_exited", "batch_aborted", "batch_sibling_withdrawn", "batch_bound_elsewhere", "adhoc_leg_no_durable_domain", "orphan_ttl_exceeded", "crashed_before_park", "shutdown_before_park"];
 export declare const SDK_RUN_DEATH_VERDICT_CODES: readonly ["run.stalled", "run.orphaned", "approval.expired"];
+export declare const SDK_APPROVAL_DECIDE_GATE_KINDS: readonly ["human", "irreversible_ask"];
+export declare const SDK_PLAN_REVIEW_GATE_KINDS: readonly ["plan_review"];

package/dist/generated/sdkFactTables.js

@@ -32,3 +32,10 @@ export const SDK_RUN_DEATH_VERDICT_CODES = Object.freeze([
     "run.orphaned",
     "approval.expired",
 ]);
+export const SDK_APPROVAL_DECIDE_GATE_KINDS = Object.freeze([
+    "human",
+    "irreversible_ask",
+]);
+export const SDK_PLAN_REVIEW_GATE_KINDS = Object.freeze([
+    "plan_review",
+]);

package/dist/generated/settingsSchemaFns.d.ts

@@ -5,6 +5,9 @@ export type SettingsAtMention = {
     readonly mode: 'only';
     readonly models: readonly string[];
 };
+export type SettingsHookMatcherForm = "literal" | "regex" | "invalid";
 export declare const SETTINGS_IS_LOOPBACK_AUTH_HOST: (host: string) => boolean;
 export declare const SETTINGS_IS_HIERARCHICAL_URL: (raw: string) => boolean;
 export declare const SETTINGS_NARROW_AT_MENTION: (atMention: SettingsAtMention, available: ReadonlySet<string>) => SettingsAtMention;
+export declare const SETTINGS_HOOK_MATCHER_SELECTS: (matcher: string | undefined, name: string) => boolean | 'invalid';
+export declare const SETTINGS_HOOK_MATCHER_FORM: (matcher: string | undefined) => SettingsHookMatcherForm;

package/dist/generated/settingsSchemaFns.js

@@ -20,3 +20,56 @@ export const SETTINGS_NARROW_AT_MENTION = function narrowAtMention(atMention, av
         return atMention;
     return kept.length > 0 ? { mode: "only", models: kept } : { mode: "none" };
 };
+const HOOK_MATCHER_NAME_LIST = /^[a-zA-Z0-9_|, -]+$/;
+const readHookMatcher = function readHookMatcher(matcher) {
+    if (matcher === undefined || matcher === "" || matcher === "*")
+        return { form: "all" };
+    if (HOOK_MATCHER_NAME_LIST.test(matcher)) {
+        return {
+            form: "names",
+            names: matcher
+                .split(/[|,]/)
+                .map((part) => part.trim())
+                .filter((part) => part !== ""),
+        };
+    }
+    try {
+        return { form: "regex", pattern: new RegExp(matcher) };
+    }
+    catch {
+        return { form: "invalid" };
+    }
+};
+export const SETTINGS_HOOK_MATCHER_SELECTS = function hookMatcherSelects(matcher, name) {
+    const r = readHookMatcher(matcher);
+    switch (r.form) {
+        case "all":
+            return true;
+        case "names":
+            return r.names.includes(name);
+        case "regex":
+            return r.pattern.test(name);
+        case "invalid":
+            return "invalid";
+        default: {
+            const unhandled = r;
+            throw new Error(`hookMatcherSelects: unhandled matcher reading ${JSON.stringify(unhandled)}`);
+        }
+    }
+};
+export const SETTINGS_HOOK_MATCHER_FORM = function hookMatcherForm(matcher) {
+    const r = readHookMatcher(matcher);
+    switch (r.form) {
+        case "all":
+        case "names":
+            return "literal";
+        case "regex":
+            return "regex";
+        case "invalid":
+            return "invalid";
+        default: {
+            const unhandled = r;
+            throw new Error(`hookMatcherForm: unhandled matcher reading ${JSON.stringify(unhandled)}`);
+        }
+    }
+};

package/dist/generated/toolNameTables.d.ts

@@ -1,2 +1,2 @@
 export declare const CORE_PROTOCOL_PREFIXES: readonly ["mcp__", "a2a__"];
-export declare const CORE_RETIRED_TOOL_CURRENT_NAMES: ReadonlyMap<string, string | null>;
+export declare const CORE_SKILL_TOOL_NAME: "Skill";

package/dist/generated/toolNameTables.js

@@ -1,43 +1,2 @@
 export const CORE_PROTOCOL_PREFIXES = ["mcp__", "a2a__"];
-export const CORE_RETIRED_TOOL_CURRENT_NAMES = new Map([
-    ["read_file", "Read"],
-    ["edit_file", "Edit"],
-    ["write_file", "Write"],
-    ["bash", "Bash"],
-    ["bash_readonly", null],
-    ["glob", "Glob"],
-    ["grep", "Grep"],
-    ["web_fetch", "WebFetch"],
-    ["tool_search", "ToolSearch"],
-    ["skill", "Skill"],
-    ["present_plan", "ExitPlanMode"],
-    ["enter_plan_mode", "EnterPlanMode"],
-    ["spawn_subagent", "Agent"],
-    ["CronCancel", "CronDelete"],
-    ["lsp", "LSP"],
-    ["submit_output", "StructuredOutput"],
-    ["repo_map", "RepoMap"],
-    ["read_tool_result", "ReadToolResult"],
-    ["report_blocked", "ReportBlocked"],
-    ["declare_done", "DeclareDone"],
-    ["run_workflow", "Workflow"],
-    ["RunWorkflow", "Workflow"],
-    ["Task", "Agent"],
-    ["BashOutput", "TaskOutput"],
-    ["AgentOutputTool", "TaskOutput"],
-    ["BashOutputTool", "TaskOutput"],
-    ["AgentOutput", "TaskOutput"],
-    ["WorkflowStatus", null],
-    ["KillShell", "TaskStop"],
-    ["KillBash", "TaskStop"],
-    ["ListMcpResources", "ListMcpResourcesTool"],
-    ["ReadMcpResource", "ReadMcpResourceTool"],
-    ["ReadMcpResourceDir", "ReadMcpResourceDirTool"],
-    ["MultiEdit", null],
-    ["Fork", null],
-    ["Sleep", null],
-    ["Remember", null],
-    ["remember", null],
-    ["Recall", null],
-    ["recall", null],
-]);
+export const CORE_SKILL_TOOL_NAME = "Skill";

package/dist/hitl/approvalDecisionNoteAudit.js

@@ -1,4 +1,4 @@
-import { displayUntrusted } from '../displayUntrusted.js';
+import { displayUntrusted, markerSafeCut } from '../displayUntrusted.js';
 const NOTE_DISPLAY_MAX = 200;
 export const DECISION_NOTE_NOTICE_KEY = 'approval-decision-note';
 function cleanNote(raw) {
@@ -7,7 +7,7 @@ function cleanNote(raw) {
         .trim();
     if (flat === '')
         return undefined;
-    return flat.length <= NOTE_DISPLAY_MAX ? flat : `${flat.slice(0, NOTE_DISPLAY_MAX - 1)}…`;
+    return flat.length <= NOTE_DISPLAY_MAX ? flat : `${flat.slice(0, markerSafeCut(flat, NOTE_DISPLAY_MAX - 1))}…`;
 }
 export function readDecisionNoteAudit(ack) {
     if (ack === null || typeof ack !== 'object')

package/dist/hitl/approvalEndingCause.d.ts

@@ -2,4 +2,6 @@ import type { ApprovalSettleCause, AskRowEndingCause } from '@sema-agent/sdk';
 export declare const ASK_ROW_ENDING_CAUSE_WORDS: readonly ["routing_failure_fail_closed", "run_cancelled", "run_exited", "batch_aborted", "batch_sibling_withdrawn", "batch_bound_elsewhere", "adhoc_leg_no_durable_domain", "orphan_ttl_exceeded", "crashed_before_park", "shutdown_before_park"];
 export declare function askRowEndingCauseFor(state: 'VOID' | 'DENIED' | undefined, word: unknown): AskRowEndingCause | undefined;
 export declare function approvalCompleteCauseOf(frame: unknown): ApprovalSettleCause | undefined;
+export declare function notPendingCauseReading(err: object): 'ended' | 'other_replica' | 'none';
+export declare function refusalCauseWordOf(err: object): string | undefined;
 export declare function notPendingCauseSaysEnded(err: object): boolean;

package/dist/hitl/approvalEndingCause.js

@@ -1,5 +1,7 @@
 import { ASK_GONE_DENIED_WORD } from '../engineErrorCodes.js';
 import { SDK_ASK_ROW_ENDING_CAUSES } from '../generated/sdkFactTables.js';
+import { guardedRead, readOwnDataValue } from '../ownKey.js';
+import { readThrownExtra } from '../wireFailureShape.js';
 export const ASK_ROW_ENDING_CAUSE_WORDS = SDK_ASK_ROW_ENDING_CAUSES;
 const _askRowCausePin = true;
 void _askRowCausePin;
@@ -25,37 +27,40 @@ export function askRowEndingCauseFor(state, word) {
         return word !== DENIED_GROUP_WORD ? word : undefined;
     return undefined;
 }
+function ownDataSlot(o, key) {
+    return guardedRead(() => readOwnDataValue(o, key));
+}
 export function approvalCompleteCauseOf(frame) {
     try {
         if (typeof frame !== 'object' || frame === null)
             return undefined;
-        const typeSlot = Object.getOwnPropertyDescriptor(frame, 'type');
-        if (typeSlot === undefined || !Object.hasOwn(typeSlot, 'value') || typeSlot.value !== 'tool_approval_complete')
-            return undefined;
-        const causeSlot = Object.getOwnPropertyDescriptor(frame, 'cause');
-        if (causeSlot === undefined || !Object.hasOwn(causeSlot, 'value'))
+        if (ownDataSlot(frame, 'type') !== 'tool_approval_complete')
             return undefined;
-        const word = causeSlot.value;
+        const word = ownDataSlot(frame, 'cause');
         return isApprovalSettleCause(word) ? word : undefined;
     }
     catch {
         return undefined;
     }
 }
-const LEGACY_NOT_PENDING_ENDED_WORDS = new Set(['voided', 'denied']);
+const NOT_PENDING_OTHER_REPLICA_WORDS = Object.freeze({
+    unknown_or_other_replica: true,
+});
+export function notPendingCauseReading(err) {
+    const word = refusalCauseWordOf(err);
+    if (word === undefined)
+        return 'none';
+    if (isAskRowEndingCause(word))
+        return 'ended';
+    return Object.hasOwn(NOT_PENDING_OTHER_REPLICA_WORDS, word) ? 'other_replica' : 'none';
+}
+export function refusalCauseWordOf(err) {
+    const reading = readThrownExtra(err);
+    if (reading.state !== 'object')
+        return undefined;
+    const word = ownDataSlot(reading.value, 'cause');
+    return typeof word === 'string' && word !== '' ? word : undefined;
+}
 export function notPendingCauseSaysEnded(err) {
-    try {
-        const extraSlot = Object.getOwnPropertyDescriptor(err, 'extra');
-        const extra = extraSlot !== undefined && Object.hasOwn(extraSlot, 'value') ? extraSlot.value : undefined;
-        if (typeof extra !== 'object' || extra === null || Array.isArray(extra))
-            return false;
-        const causeSlot = Object.getOwnPropertyDescriptor(extra, 'cause');
-        if (causeSlot === undefined || !Object.hasOwn(causeSlot, 'value'))
-            return false;
-        const word = causeSlot.value;
-        return isAskRowEndingCause(word) || (typeof word === 'string' && LEGACY_NOT_PENDING_ENDED_WORDS.has(word));
-    }
-    catch {
-        return false;
-    }
+    return notPendingCauseReading(err) === 'ended';
 }

package/dist/hitl/approvalHolds.d.ts

@@ -1,4 +1,12 @@
 import type { ApprovalHolderIdentity, FsApprovalOutcome, ToolApprovalFrameOutcome } from './toolApprovalWire.js';
+export declare const APPROVAL_SETTLED_HOWS: readonly ["answered", "interrupted", "closed_by_engine"];
+export type ApprovalSettledHow = (typeof APPROVAL_SETTLED_HOWS)[number];
+export declare const SETTLED_APPROVALS_MAX_ENTRIES = 4096;
+export interface SettledApprovalEntry {
+    readonly how: ApprovalSettledHow;
+    readonly parked: boolean;
+    readonly outcome: ToolApprovalFrameOutcome;
+}
 export interface DurableDecisionHold {
     readonly lane: 'durable';
     readonly outcome: Promise<FsApprovalOutcome>;
@@ -17,7 +25,7 @@ export interface LiveCardHold {
     };
     readonly cardSignal: AbortSignal;
     readonly interrupt: () => void;
-    trailing?: Promise<void>;
+    trailing?: Promise<boolean>;
 }
 export type ApprovalHold = DurableDecisionHold | LiveCardHold;
 export interface LiveCardIdentity {
@@ -27,12 +35,14 @@ export interface LiveCardIdentity {
     readonly sessionId?: string;
 }
 export declare function liveCardHoldFor(who: ApprovalHolderIdentity): LiveCardHold | undefined;
+export declare function settledForDurableLane(entry: SettledApprovalEntry | undefined): boolean;
 export declare function liveCardAnsweredHow(o: ToolApprovalFrameOutcome): 'answered' | 'interrupted' | undefined;
 export declare function awaitLiveCardHolder(hold: LiveCardHold, signal: AbortSignal | undefined): Promise<ToolApprovalFrameOutcome | undefined>;
 export interface ApprovalDecisionHoldTable {
     readonly inFlight: Map<string, ApprovalHold>;
     readonly settled: Map<string, DurableSettledHold>;
     readonly openReads: Set<number>;
+    readonly outcomes: Map<string, SettledApprovalEntry>;
     clock: number;
 }
 export interface DurableSettledHold {
@@ -40,6 +50,11 @@ export interface DurableSettledHold {
     readonly hold: DurableDecisionHold;
 }
 export declare const approvalDecisionHolds: ApprovalDecisionHoldTable;
+export declare function settledApprovalOf(approvalId: string | undefined): SettledApprovalEntry | undefined;
+export declare function clearSettledApprovals(): void;
+export declare function anyApprovalSettled(): boolean;
+export declare function noteEngineClosedApproval(approvalId: string, parked: boolean): void;
+export declare function settledLiveCardOutcome(approvalId: string): ToolApprovalFrameOutcome | undefined;
 export declare function liveCardHoldOf(key: string): LiveCardHold | undefined;
 export declare function holdLiveCard(identity: LiveCardIdentity, callerSignal: AbortSignal | undefined, present: (hold: LiveCardHold) => Promise<ToolApprovalFrameOutcome>): Promise<ToolApprovalFrameOutcome>;
 export declare function joinLiveCard(hold: LiveCardHold, signal: AbortSignal | undefined): Promise<ToolApprovalFrameOutcome>;