@sema-agent/client-core 0.98.0 → 0.100.0

package/dist/retryStatus.js

@@ -1,5 +1,6 @@
 import { displayUntrusted } from './displayUntrusted.js';
 import { guardedRead, readOwnDataFiniteNumber, readOwnDataNonEmptyString, readOwnDataValue } from './ownKey.js';
+import { msg, renderMessage } from './i18n/translate.js';
 export const BRAIN_STATUS_PHASES = [
     'rate_limited',
     'retrying',
@@ -78,6 +79,47 @@ export function mapBrainStatusToRetry(p, nowMs) {
             return { kind: 'error', deadline, ...extra, error: { formatted: '' } };
     }
 }
+export function retryStatusFromArm(arm, nowMs) {
+    const object = guardedRead(() => typeof arm === 'object' && arm !== null && !Array.isArray(arm));
+    if (object !== true || arm === null || arm === undefined)
+        return undefined;
+    const bit = (key) => guardedRead(() => readOwnDataValue(arm, key));
+    if (typeof bit('parentToolCallId') === 'string')
+        return undefined;
+    const num = (key) => {
+        const v = bit(key);
+        return typeof v === 'number' && Number.isFinite(v) ? v : undefined;
+    };
+    const str = (key) => {
+        const v = bit(key);
+        return typeof v === 'string' ? v : undefined;
+    };
+    const word = (key) => {
+        const v = str(key);
+        return v !== undefined && v.length > 0 ? v : undefined;
+    };
+    const [detail, retryInSec, retryInMs, attempt, maxRetries, errClass, retryAtMs, errorStatus, elapsedMs, timeoutMs, providerCondition, providerConditionSource] = [
+        str('detail'), num('retryInSec'), num('retryInMs'), num('attempt'), num('maxRetries'), str('errClass'), num('retryAtMs'), num('errorStatus'), num('elapsedMs'), num('timeoutMs'), word('providerCondition'), word('providerConditionSource'),
+    ];
+    const phase = str('phase');
+    if (phase === undefined)
+        return undefined;
+    return mapBrainStatusToRetry({
+        phase,
+        ...(detail !== undefined ? { detail } : {}),
+        ...(retryInSec !== undefined ? { retryInSec } : {}),
+        ...(retryInMs !== undefined ? { retryInMs } : {}),
+        ...(attempt !== undefined ? { attempt } : {}),
+        ...(maxRetries !== undefined ? { maxRetries } : {}),
+        ...(errClass !== undefined ? { errClass } : {}),
+        ...(retryAtMs !== undefined ? { retryAtMs } : {}),
+        ...(errorStatus !== undefined ? { errorStatus } : {}),
+        ...(elapsedMs !== undefined ? { elapsedMs } : {}),
+        ...(timeoutMs !== undefined ? { timeoutMs } : {}),
+        ...(providerCondition !== undefined ? { providerCondition } : {}),
+        ...(providerConditionSource !== undefined ? { providerConditionSource } : {}),
+    }, nowMs);
+}
 const WAIT_SWITCH_FRACTION = 0.5;
 const CONDITION_READINGS = Object.freeze({
     quota_exhausted: { clause: 'this account cannot be served by the model service until someone acts or its usage window resets', recourse: 'switch_model' },
@@ -131,11 +173,38 @@ function noticeAttemptTail(attempt, maxRetries) {
 function sealNotice(line, phase, recourse) {
     return Object.freeze(recourse === undefined ? { line, phase } : { line, recourse, phase });
 }
-export function retryStatusNotice(status, ctx) {
+const SOURCE_PHRASES = Object.freeze({
+    unified_header: 'notice.retry.source.unifiedHeader',
+    provider_code: 'notice.retry.source.providerCode',
+    status: 'notice.retry.source.status',
+});
+function sourcePhraseOf(word) {
+    if (word === undefined || !Object.hasOwn(SOURCE_PHRASES, word))
+        return undefined;
+    return renderMessage(msg(SOURCE_PHRASES[word]));
+}
+function sealParts(p) {
+    return Object.freeze({
+        phase: p.phase,
+        ...(p.model !== undefined ? { model: p.model } : {}),
+        ...(p.condition !== undefined ? { condition: p.condition } : {}),
+        ...(p.resendNote !== undefined ? { resendNote: p.resendNote } : {}),
+        ...(p.httpStatus !== undefined ? { httpStatus: p.httpStatus } : {}),
+        ...(p.source !== undefined ? { source: p.source } : {}),
+        ...(p.attempt !== undefined ? { attempt: p.attempt } : {}),
+        ...(p.maxAttempts !== undefined ? { maxAttempts: p.maxAttempts } : {}),
+        ...(p.elapsedMs !== undefined ? { elapsedMs: p.elapsedMs } : {}),
+        ...(p.timeoutMs !== undefined ? { timeoutMs: p.timeoutMs } : {}),
+        ...(p.retryAtMs !== undefined ? { retryAtMs: p.retryAtMs } : {}),
+        ...(p.detail !== undefined ? { detail: p.detail } : {}),
+        ...(p.recourse !== undefined ? { recourse: p.recourse } : {}),
+    });
+}
+export function retryStatusParts(status, ctx) {
     const modelName = washedText(noticeText(ctx, 'modelName'))?.trim();
-    const prefix = modelName === undefined || modelName === '' ? '' : `${modelName}: `;
+    const model = modelName === undefined || modelName === '' ? undefined : modelName;
     if (status === null)
-        return sealNotice('', 'cleared', undefined);
+        return sealParts({ phase: 'cleared' });
     const armWord = noticeText(status, 'kind');
     const kind = armWord === 'stalled' || armWord === 'waiting' ? armWord : 'error';
     if (kind === 'waiting') {
@@ -143,10 +212,8 @@ export function retryStatusNotice(status, ctx) {
         const timeoutRaw = noticeNumber(status, 'timeoutMs');
         const elapsed = elapsedRaw !== undefined && elapsedRaw >= 0 && elapsedRaw <= Number.MAX_SAFE_INTEGER ? elapsedRaw : undefined;
         const ceiling = timeoutRaw !== undefined && timeoutRaw > 0 && timeoutRaw <= Number.MAX_SAFE_INTEGER ? timeoutRaw : undefined;
-        const progress = [...(elapsed === undefined ? [] : [`${spanText(elapsed)} so far`]), ...(ceiling === undefined ? [] : [`limit ${spanText(ceiling)}`])];
-        const offerSwitch = prefix !== '' && elapsed !== undefined && ceiling !== undefined && elapsed >= ceiling * WAIT_SWITCH_FRACTION;
-        const text = `${prefix}Waiting for the model's first token${progress.length === 0 ? '' : ` — ${progress.join(', ')}`}${offerSwitch ? '; keep waiting or switch model' : ''}`;
-        return sealNotice(text, 'waiting_first_token', offerSwitch ? 'switch_model' : 'wait');
+        const offerSwitch = model !== undefined && elapsed !== undefined && ceiling !== undefined && elapsed >= ceiling * WAIT_SWITCH_FRACTION;
+        return sealParts({ phase: 'waiting_first_token', model, elapsedMs: elapsed, timeoutMs: ceiling, recourse: offerSwitch ? 'switch_model' : 'wait' });
     }
     const terminal = kind === 'error' && noticeValue(status, 'terminal') === true;
     const reading = conditionReadingOf(noticeText(status, 'providerCondition'));
@@ -154,18 +221,9 @@ export function retryStatusNotice(status, ctx) {
     const attempt = noticeCount(noticeNumber(status, 'attempt'));
     const maxRetries = noticeCount(noticeNumber(status, 'maxRetries'));
     const engineWords = kind === 'stalled' ? noticeText(status, 'detail') : noticeText(noticeValue(status, 'error'), 'formatted');
-    const httpPart = http === undefined ? '' : ` (HTTP ${http})`;
-    let first;
-    if (terminal) {
-        const after = attempt === undefined ? '' : ` after ${attempt} attempt${attempt === 1 ? '' : 's'}`;
-        const why = reading === undefined ? '' : `: ${reading.clause}${reading.resendNote === undefined ? '' : `, and ${reading.resendNote}`}`;
-        first = `Stopped${after}${why}${httpPart}`;
-    }
-    else {
-        const head = reading !== undefined ? `${reading.clause.charAt(0).toUpperCase()}${reading.clause.slice(1)}` : http !== undefined || kind === 'error' ? 'Request failed' : 'Waiting for the API response';
-        first = `${head}${httpPart} — ${kind === 'stalled' ? 'will retry' : 'retrying'}${noticeAttemptTail(attempt, maxRetries)}`;
-    }
     const note = washedText(engineWords);
+    const source = reading === undefined ? undefined : sourcePhraseOf(noticeText(status, 'providerConditionSource'));
+    const condition = reading === undefined ? undefined : `${reading.clause.charAt(0).toUpperCase()}${reading.clause.slice(1)}`;
     const serviceSide = http !== undefined && (http === 429 || (http >= 500 && http <= 599));
     const knownArm = armWord === 'stalled' || armWord === 'error';
     const recourse = !knownArm
@@ -177,5 +235,83 @@ export function retryStatusNotice(status, ctx) {
                 : !terminal
                     ? 'wait'
                     : undefined;
-    return sealNotice(`${prefix}${first}${note === undefined ? '' : ` · ${note}`}`, kind === 'stalled' ? 'reconnecting' : terminal ? 'gave_up' : 'retrying', recourse);
+    const deadlineRaw = knownArm && !terminal && noticeNumber(status, 'retryAtMs') !== undefined ? noticeNumber(status, 'deadline') : undefined;
+    const retryAtMs = deadlineRaw !== undefined && deadlineRaw > 0 ? deadlineRaw : undefined;
+    return sealParts({
+        phase: kind === 'stalled' ? 'reconnecting' : terminal ? 'gave_up' : 'retrying',
+        model,
+        condition,
+        resendNote: terminal ? reading?.resendNote : undefined,
+        httpStatus: http,
+        source,
+        attempt,
+        maxAttempts: maxRetries,
+        retryAtMs,
+        detail: note,
+        recourse,
+    });
+}
+function retryLineOfParts(parts) {
+    if (parts.phase === 'cleared')
+        return '';
+    const prefix = parts.model === undefined ? '' : `${parts.model}: `;
+    if (parts.phase === 'waiting_first_token') {
+        const progress = [...(parts.elapsedMs === undefined ? [] : [`${spanText(parts.elapsedMs)} so far`]), ...(parts.timeoutMs === undefined ? [] : [`limit ${spanText(parts.timeoutMs)}`])];
+        const offerSwitch = parts.recourse === 'switch_model';
+        return `${prefix}Waiting for the model's first token${progress.length === 0 ? '' : ` — ${progress.join(', ')}`}${offerSwitch ? '; keep waiting or switch model' : ''}`;
+    }
+    const httpPart = parts.httpStatus === undefined ? '' : ` (HTTP ${parts.httpStatus})`;
+    let first;
+    if (parts.phase === 'gave_up') {
+        const after = parts.attempt === undefined ? '' : ` after ${parts.attempt} attempt${parts.attempt === 1 ? '' : 's'}`;
+        const why = parts.condition === undefined ? '' : `: ${parts.condition.charAt(0).toLowerCase()}${parts.condition.slice(1)}${parts.resendNote === undefined ? '' : `, and ${parts.resendNote}`}`;
+        first = `Stopped${after}${why}${httpPart}`;
+    }
+    else {
+        const head = parts.condition !== undefined ? parts.condition : parts.httpStatus !== undefined || parts.phase === 'retrying' ? 'Request failed' : 'Waiting for the API response';
+        first = `${head}${httpPart} — ${parts.phase === 'reconnecting' ? 'will retry' : 'retrying'}${noticeAttemptTail(parts.attempt, parts.maxAttempts)}`;
+    }
+    return `${prefix}${first}${parts.detail === undefined ? '' : ` · ${parts.detail}`}`;
+}
+export function retryStatusNotice(status, ctx) {
+    const parts = retryStatusParts(status, ctx);
+    return sealNotice(retryLineOfParts(parts), parts.phase, parts.recourse);
+}
+const API_ERROR_PROVIDER_TEXT_MAX = 200;
+function isRecordObject(v) {
+    return guardedRead(() => typeof v === 'object' && v !== null && !Array.isArray(v)) === true;
+}
+export function apiErrorFactsOfRow(row) {
+    if (!isRecordObject(row))
+        return Object.freeze({});
+    const status = noticeHttp(noticeNumber(row, '_sema_api_error_status'));
+    const providerCondition = noticeText(row, '_sema_provider_condition');
+    const errorCode = noticeText(row, '_sema_api_error_code');
+    return Object.freeze({
+        ...(status !== undefined ? { status } : {}),
+        ...(providerCondition !== undefined ? { providerCondition } : {}),
+        ...(errorCode !== undefined ? { errorCode } : {}),
+    });
+}
+export function apiErrorNotice(facts, ctx) {
+    if (!isRecordObject(facts))
+        return undefined;
+    const status = noticeHttp(noticeNumber(facts, 'status'));
+    const providerCondition = noticeText(facts, 'providerCondition');
+    if (status === undefined && conditionReadingOf(providerCondition) === undefined)
+        return undefined;
+    const rawText = noticeText(ctx, 'providerText');
+    const shownText = rawText === undefined ? undefined : washedText(displayUntrusted(rawText, { max: API_ERROR_PROVIDER_TEXT_MAX }));
+    const terminal = {
+        kind: 'error',
+        deadline: 0,
+        terminal: true,
+        ...(status !== undefined ? { errorStatus: status } : {}),
+        ...(providerCondition !== undefined ? { providerCondition } : {}),
+        error: { formatted: shownText ?? '' },
+    };
+    const modelName = noticeText(ctx, 'modelName');
+    const notice = retryStatusNotice(terminal, modelName !== undefined ? { modelName } : undefined);
+    const recourse = status === 401 || status === 403 ? 'check_credentials' : notice.recourse;
+    return Object.freeze(recourse === undefined ? { line: notice.line } : { line: notice.line, recourse });
 }

package/dist/ruleRefusalSentence.d.ts

@@ -0,0 +1,4 @@
+import type { UiLanguage } from './env/uiLanguage.js';
+import type { PermissionsKeptRule } from './permissionsDeclaration.js';
+export type RuleRefusalRow = Pick<PermissionsKeptRule, 'rule' | 'reason' | 'code' | 'message'>;
+export declare function ruleRefusalSentence(rows: readonly RuleRefusalRow[], lang?: UiLanguage): string | undefined;

package/dist/ruleRefusalSentence.js

@@ -0,0 +1,58 @@
+import { capForDisplay } from './fleetTaskDesc.js';
+import { msg, renderMessage } from './i18n/translate.js';
+import { permissionRuleIssueDetail } from './permissionRuleIssue.js';
+const RULE_REFUSAL_NAMED_MAX = 5;
+const RULE_NAME_MAX = 120;
+const CLASS_OF_REASON = Object.freeze({
+    retired_tool_name: 'toolName',
+    unprefixed_namespaced_name: 'toolName',
+    incomplete_protocol_name: 'toolName',
+    home_relative_path: 'homePath',
+    compile_refused: 'compile',
+    paren_in_tool_name: 'compile',
+});
+function reasonOf(row, lang) {
+    const cls = typeof row.reason === 'string' && Object.hasOwn(CLASS_OF_REASON, row.reason) ? CLASS_OF_REASON[row.reason] : undefined;
+    if (cls === 'toolName')
+        return renderMessage(msg('rules.refusal.reason.toolName'), lang);
+    if (cls === 'homePath')
+        return renderMessage(msg('rules.refusal.reason.homePath'), lang);
+    if (cls === 'compile')
+        return permissionRuleIssueDetail(row.code, row.message, row.rule, lang);
+    return undefined;
+}
+function nameOf(rule) {
+    return `"${capForDisplay(rule, RULE_NAME_MAX)}"`;
+}
+export function ruleRefusalSentence(rows, lang) {
+    const seen = new Set();
+    const items = [];
+    try {
+        if (!Array.isArray(rows))
+            return undefined;
+        for (const row of rows) {
+            if (typeof row !== 'object' || row === null)
+                continue;
+            const rule = row.rule;
+            if (typeof rule !== 'string' || rule === '' || seen.has(rule))
+                continue;
+            const reason = reasonOf(row, lang);
+            if (reason === undefined)
+                continue;
+            seen.add(rule);
+            items.push({ rule, reason });
+        }
+    }
+    catch {
+        return undefined;
+    }
+    if (items.length === 0)
+        return undefined;
+    const shown = items.slice(0, RULE_REFUSAL_NAMED_MAX);
+    const separator = renderMessage(msg('rules.refusal.itemSeparator'), lang);
+    const named = shown.map((it) => renderMessage(msg('rules.refusal.item', { rule: nameOf(it.rule), reason: it.reason }), lang)).join(separator);
+    const rest = items.length - shown.length;
+    const list = rest > 0 ? msg('rules.refusal.list.more', { shown: named, count: rest }) : named;
+    const listText = typeof list === 'string' ? list : renderMessage(list, lang);
+    return renderMessage(items.length === 1 ? msg('rules.refusal.sentence.one', { list: listText }) : msg('rules.refusal.sentence.other', { count: items.length, list: listText }), lang);
+}

package/dist/sandboxWire.d.ts

@@ -1,3 +1,4 @@
+import type { TaskRequestLike } from './request/taskRequest.js';
 export type SandboxSelection = {
     mode: 'default';
 } | {
@@ -25,4 +26,4 @@ export declare const SANDBOX_NO_PUBLISHED_IMAGE_404_ANCHOR = "no published sandb
 export declare const SANDBOX_CASCADE_CONFLICT_400_ANCHOR = "not supported together with cascade/verify";
 export type SandboxHintHost = 'terminal' | 'web' | 'desktop';
 export declare const SANDBOX_HINT_HOSTS: readonly SandboxHintHost[];
-export declare function sandboxDegradeHint(err: unknown, host?: SandboxHintHost): string | undefined;
+export declare function sandboxDegradeHint(err: unknown, host?: SandboxHintHost, sentRequest?: TaskRequestLike): string | undefined;

package/dist/sandboxWire.js

@@ -1,5 +1,5 @@
 import { lastFlagValue } from './argvFlagValue.js';
-import { CAPABILITY_IMAGE_INDEX_REQUIRED } from './engineErrorCodes.js';
+import { CAPABILITY_IMAGE_INDEX_REQUIRED, CAPABILITY_K8S_LANE_REQUIRED, isStatusDerivedCoarseCode, NOT_FOUND_IMAGE, REQUEST_FIELD_CONFLICT, REQUEST_PRECONDITION_UNMET } from './engineErrorCodes.js';
 import { THROWN_SLOT_UNREADABLE, readThrownSlot } from './wireFailureShape.js';
 const MAX_PROFILE_LEN = 128;
 const USAGE_HINT = "sema: --sandbox expects a profile name or 'auto'.\n" +
@@ -49,15 +49,15 @@ export const SANDBOX_NO_PUBLISHED_IMAGE_404_ANCHOR = 'no published sandbox image
 export const SANDBOX_CASCADE_CONFLICT_400_ANCHOR = 'not supported together with cascade/verify';
 export const SANDBOX_HINT_HOSTS = Object.freeze(['terminal', 'web', 'desktop']);
 const SANDBOX_HINT_ARMS = Object.freeze({
-    imageIndexRequired501: {
-        fact: 'Cloud sandbox images are not available on this engine: its storage backend keeps no image index, so profiles cannot be listed or selected here.',
+    imageIndexRequired: {
+        fact: 'Cloud sandbox images are not available on this engine: it has no sandbox image index (its store keeps none, or no image catalog is attached from the sema-web-admin config center), so profiles cannot be listed or selected here.',
         sep: '\n',
         outlet: {
-            terminal: 'Use a worker backed by a SQL store (it has the image index), or re-run without --sandbox.',
-            graphical: 'Use a worker backed by a SQL store (it has the image index), or keep the default environment.',
+            terminal: 'Use a worker that has the image index (a SQL-backed store with the image catalog attached), or re-run without --sandbox.',
+            graphical: 'Use a worker that has the image index (a SQL-backed store with the image catalog attached), or keep the default environment.',
         },
     },
-    k8sLaneOnly400: {
+    k8sLaneOnly: {
         subject: { terminal: '--sandbox <profile>', graphical: 'The selected sandbox image profile' },
         fact: ' only applies on k8s-lane workers; this engine runs a host/e2b sandbox lane, so the request was honestly rejected.',
         sep: '\n',
@@ -66,12 +66,13 @@ const SANDBOX_HINT_ARMS = Object.freeze({
             graphical: 'Keep the default environment, or connect to a k8s-lane worker.',
         },
     },
-    noImageIndex400: {
-        fact: 'This worker has no sandbox image index configured (the sema-web-admin config center is not attached), so per-task profiles cannot resolve.',
+    sessionRequired: {
+        subject: { terminal: '--sandbox <profile>', graphical: 'The selected sandbox image profile' },
+        fact: ' is bound to a session, and this request resolved none, so the per-task image could not be registered.',
         sep: '\n',
         outlet: {
-            terminal: 'Re-run without --sandbox, or use a worker with the image index enabled.',
-            graphical: 'Keep the default environment, or use a worker with the image index enabled.',
+            terminal: 'Run it inside a session, or re-run without --sandbox.',
+            graphical: 'Start the work inside a session, or keep the default environment.',
         },
     },
     noPublishedImage404: {
@@ -104,21 +105,54 @@ function sandboxSlot(err, key) {
     const v = readThrownSlot(err, key, 'data');
     return v === THROWN_SLOT_UNREADABLE ? undefined : v;
 }
-export function sandboxDegradeHint(err, host) {
-    const status = sandboxSlot(err, 'status');
-    if (status === 501 && sandboxSlot(err, 'errorCode') === CAPABILITY_IMAGE_INDEX_REQUIRED)
-        return sandboxHintOf(SANDBOX_HINT_ARMS.imageIndexRequired501, host);
-    if (typeof err !== 'object' || err === null || typeof status !== 'number')
-        return undefined;
+function sentSandboxFacts(sentRequest) {
+    if (sentRequest === undefined || sentRequest === null || typeof sentRequest !== 'object')
+        return { profile: false, cascadeOrVerify: false, sessionOrDevice: false };
+    const profile = sandboxSlot(sentRequest, 'sandboxImageProfile');
+    const sent = (key) => {
+        const v = sandboxSlot(sentRequest, key);
+        return typeof v === 'string' && v.length > 0;
+    };
+    return {
+        profile: typeof profile === 'string' && profile.length > 0,
+        cascadeOrVerify: sandboxSlot(sentRequest, 'cascade') === true || sandboxSlot(sentRequest, 'verify') === true,
+        sessionOrDevice: sent('sessionId') || sent('deviceId'),
+    };
+}
+export function sandboxDegradeHint(err, host, sentRequest) {
     try {
+        if (typeof err !== 'object' || err === null)
+            return undefined;
+        const status = sandboxSlot(err, 'status');
+        const codeRaw = sandboxSlot(err, 'errorCode');
+        const code = typeof codeRaw === 'string' && codeRaw.length > 0 ? codeRaw : undefined;
+        if (status === 501 && code === CAPABILITY_K8S_LANE_REQUIRED)
+            return sandboxHintOf(SANDBOX_HINT_ARMS.k8sLaneOnly, host);
+        if (status === 501 && code === CAPABILITY_IMAGE_INDEX_REQUIRED)
+            return sandboxHintOf(SANDBOX_HINT_ARMS.imageIndexRequired, host);
+        if (status === 404 && code === NOT_FOUND_IMAGE)
+            return sandboxHintOf(SANDBOX_HINT_ARMS.noPublishedImage404, host);
+        if (status === 400 && code === REQUEST_PRECONDITION_UNMET) {
+            const sent = sentSandboxFacts(sentRequest);
+            return sent.profile && !sent.cascadeOrVerify && !sent.sessionOrDevice ? sandboxHintOf(SANDBOX_HINT_ARMS.sessionRequired, host) : undefined;
+        }
+        if (typeof status !== 'number')
+            return undefined;
+        const noCode = code === undefined || isStatusDerivedCoarseCode(code);
+        const cascadeCoded = code === REQUEST_FIELD_CONFLICT && (sentRequest === undefined || (() => {
+            const sent = sentSandboxFacts(sentRequest);
+            return sent.profile && sent.cascadeOrVerify;
+        })());
+        if (!noCode && !cascadeCoded)
+            return undefined;
         const msg = err.message;
         if (typeof msg !== 'string')
             return undefined;
-        if (status === 400 && msg.includes(SANDBOX_K8S_ONLY_400_ANCHOR))
-            return sandboxHintOf(SANDBOX_HINT_ARMS.k8sLaneOnly400, host);
-        if (status === 400 && msg.includes(SANDBOX_NO_IMAGE_INDEX_400_ANCHOR))
-            return sandboxHintOf(SANDBOX_HINT_ARMS.noImageIndex400, host);
-        if (status === 404 && msg.includes(SANDBOX_NO_PUBLISHED_IMAGE_404_ANCHOR))
+        if (noCode && status === 400 && msg.includes(SANDBOX_K8S_ONLY_400_ANCHOR))
+            return sandboxHintOf(SANDBOX_HINT_ARMS.k8sLaneOnly, host);
+        if (noCode && status === 400 && msg.includes(SANDBOX_NO_IMAGE_INDEX_400_ANCHOR))
+            return sandboxHintOf(SANDBOX_HINT_ARMS.imageIndexRequired, host);
+        if (noCode && status === 404 && msg.includes(SANDBOX_NO_PUBLISHED_IMAGE_404_ANCHOR))
             return sandboxHintOf(SANDBOX_HINT_ARMS.noPublishedImage404, host);
         if (status === 400 && msg.includes(SANDBOX_CASCADE_CONFLICT_400_ANCHOR))
             return sandboxHintOf(SANDBOX_HINT_ARMS.cascadeConflict400, host);

package/dist/scenarioRefusal.d.ts

@@ -0,0 +1,10 @@
+import type { UiLanguage } from './env/uiLanguage.js';
+export interface ScenarioRefusalReading {
+    readonly errorCode?: string;
+    readonly error?: string;
+    readonly scenario?: string;
+    readonly source?: 'ruling' | 'deployment';
+}
+export declare function scenarioRefusalOf(body: object): ScenarioRefusalReading | undefined | null;
+export declare function scenarioRefusalFromError(err: {} | null | undefined): ScenarioRefusalReading | null;
+export declare function scenarioRefusalContent(reading: ScenarioRefusalReading, lang?: UiLanguage): string;

package/dist/scenarioRefusal.js

@@ -0,0 +1,111 @@
+import { capForDisplay } from './fleetTaskDesc.js';
+import { readOwnDataValue } from './ownKey.js';
+import { SCENARIO_ASSIGNMENT_UNKNOWN_ERROR_CODE } from './engineErrorCodes.js';
+import { readErrorRecord, readErrorString } from './wireFailureShape.js';
+import { effectiveWireErrorCode } from './wireErrorTriage.js';
+import { msg, renderMessage } from './i18n/translate.js';
+const SCENARIO_REFUSAL_ERROR_MAX = 200;
+function detailBits(detail) {
+    if (detail === undefined)
+        return {};
+    let scenario;
+    let source;
+    try {
+        scenario = readOwnDataValue(detail, 'scenario');
+    }
+    catch {
+        scenario = undefined;
+    }
+    try {
+        source = readOwnDataValue(detail, 'source');
+    }
+    catch {
+        source = undefined;
+    }
+    return {
+        ...(typeof scenario === 'string' && scenario.length > 0 ? { scenario } : {}),
+        ...(source === 'ruling' || source === 'deployment' ? { source } : {}),
+    };
+}
+const isPlainRecord = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+export function scenarioRefusalOf(body) {
+    let raw;
+    try {
+        const d = Object.getOwnPropertyDescriptor(body, 'scenarioRefusal');
+        if (d === undefined)
+            return undefined;
+        raw = 'value' in d ? d.value : undefined;
+    }
+    catch {
+        return null;
+    }
+    try {
+        if (!isPlainRecord(raw))
+            return Object.freeze({});
+        const own = (key) => {
+            try {
+                return readOwnDataValue(raw, key);
+            }
+            catch {
+                return undefined;
+            }
+        };
+        const errorCode = own('errorCode');
+        const error = own('error');
+        const detail = own('detail');
+        let bits = {};
+        try {
+            bits = detailBits(isPlainRecord(detail) ? detail : undefined);
+        }
+        catch {
+            bits = {};
+        }
+        return Object.freeze({
+            ...(typeof errorCode === 'string' && errorCode.length > 0 ? { errorCode } : {}),
+            ...(typeof error === 'string' && error.length > 0 ? { error: capForDisplay(error, SCENARIO_REFUSAL_ERROR_MAX) } : {}),
+            ...bits,
+        });
+    }
+    catch {
+        return Object.freeze({});
+    }
+}
+export function scenarioRefusalFromError(err) {
+    try {
+        if (err === null || typeof err !== 'object')
+            return null;
+        if (effectiveWireErrorCode(err) !== SCENARIO_ASSIGNMENT_UNKNOWN_ERROR_CODE)
+            return null;
+        const error = readErrorString(err, 'message');
+        return Object.freeze({
+            errorCode: SCENARIO_ASSIGNMENT_UNKNOWN_ERROR_CODE,
+            ...(error !== undefined && error.length > 0 ? { error: capForDisplay(error, SCENARIO_REFUSAL_ERROR_MAX) } : {}),
+            ...detailBits(readErrorRecord(err, 'detail')),
+        });
+    }
+    catch {
+        return null;
+    }
+}
+export function scenarioRefusalContent(reading, lang) {
+    let code;
+    let scenario;
+    let source;
+    try {
+        code = isPlainRecord(reading) ? readOwnDataValue(reading, 'errorCode') : undefined;
+        scenario = isPlainRecord(reading) ? readOwnDataValue(reading, 'scenario') : undefined;
+        source = isPlainRecord(reading) ? readOwnDataValue(reading, 'source') : undefined;
+    }
+    catch {
+        code = undefined;
+        scenario = undefined;
+        source = undefined;
+    }
+    if (code === SCENARIO_ASSIGNMENT_UNKNOWN_ERROR_CODE) {
+        const name = typeof scenario === 'string' && scenario.length > 0 ? ` ("${capForDisplay(scenario, 80)}")` : '';
+        const from = source === 'ruling' ? msg('config.scenarioRefusal.source.ruling') : source === 'deployment' ? msg('config.scenarioRefusal.source.deployment') : '';
+        return renderMessage(msg('config.scenarioRefusal.dangling', { name, from }), lang);
+    }
+    const tail = typeof code === 'string' && code.length > 0 ? ` (${capForDisplay(code, 80)})` : '';
+    return renderMessage(msg('config.scenarioRefusal.generic', { tail }), lang);
+}

package/dist/seam.d.ts

@@ -1,11 +1,12 @@
 import type { ModelUsage, SDKMessage } from '@sema-agent/agent-types';
 import type { EngineTurnUsage } from './adapter/downstream/turnUsageToModelUsage.js';
 import type { RunCostReconcile } from './adapter/downstream/terminalToSdkResult.js';
-import type { WiringManifestAutoMode, WiringManifestModelGate, WiringManifestMcpEntryView, WiringManifestHookEntryView, WiringManifestLspSeamView, WiringManifestWriteProtectionView, WiringManifestAutoConsolidationView, WiringManifestReadDenyView, ContextUsageSectionView, PromptManifestSectionView, PromptManifestBlockView, PromptManifestToolView } from './adapter/downstream/eventToSdkMessage.js';
+import type { WiringManifestAutoMode, WiringManifestModelGate, WiringManifestMcpEntryView, WiringManifestHookEntryView, WiringManifestLspSeamView, WiringManifestWriteProtectionView, WiringManifestAutoConsolidationView, WiringManifestReadDenyView, WiringManifestModView, ContextUsageSectionView, PromptManifestSectionView, PromptManifestBlockView, PromptManifestToolView, PromptManifestIdentityView } from './adapter/downstream/eventToSdkMessage.js';
 import type { ToolRosterView, ToolRosterDeltaView, WiringManifestHandsView } from './toolRoster.js';
 import type { WiringManifestFleetView } from './adapter/downstream/wiringManifestView.js';
 import type { SuspendedReopenReading } from './hitl/suspendedReopen.js';
 import type { ToolKillCause } from './toolResult.js';
+import type { HumanInputAttachmentView } from './ownKey.js';
 export interface AbortSignalLike {
     readonly aborted: boolean;
 }
@@ -33,13 +34,6 @@ export interface AdapterContext {
         readonly toolName: string;
     }): ToolKillCause | undefined;
     coalesceIntervalMs?: number;
-    continuesPark?: ContinuesParkDeclaration;
-}
-export interface ContinuesParkDeclaration {
-    readonly toolCallId: string;
-    readonly checkpointId?: string;
-    readonly parkedTaskId?: string;
-    readonly continuationTaskId?: string;
 }
 export type ChromeEvent = {
     kind: 'retry_status';
@@ -143,6 +137,7 @@ export type ChromeEvent = {
     laneProof: LaneProof;
     usage: ModelUsage;
     engineUsage?: EngineTurnUsage;
+    engineUsageUnknownKeys?: number;
     usageMissing?: true;
     stopReason?: string;
     responseModel?: string;
@@ -154,6 +149,7 @@ export type ChromeEvent = {
     parentToolCallId: string;
     usage?: ModelUsage;
     engineUsage?: EngineTurnUsage;
+    engineUsageUnknownKeys?: number;
     usageMissing?: true;
     stopReason?: string;
     responseModel?: string;
@@ -164,7 +160,7 @@ export type ChromeEvent = {
 } | ({
     kind: 'run_cost_reconciled';
     laneProof: LaneProof;
-} & RunCostReconcile) | HumanInputChromeEvent | MessageCommittedChromeEvent | EngineNoticeChromeEvent | TextSegmentEndChromeEvent | ThinkingSegmentEndChromeEvent | ToolDisclosureChromeEvent | ToolProgressChromeEvent | ToolRosterDeltaChromeEvent | ContextUsageChromeEvent | CompactionOutcomeChromeEvent | PromptAssembledChromeEvent | MemorySavedChromeEvent | WiringManifestChromeEvent | ResultTextDivergedChromeEvent | ResultReplayedChromeEvent | ToolParkedChromeEvent | ApprovalRequestChromeEvent | ApprovalRevokeChromeEvent | {
+} & RunCostReconcile) | HumanInputChromeEvent | MessageCommittedChromeEvent | EngineNoticeChromeEvent | TextSegmentEndChromeEvent | ThinkingSegmentEndChromeEvent | ToolDisclosureChromeEvent | ToolProgressChromeEvent | ToolRosterDeltaChromeEvent | ContextUsageChromeEvent | CompactionOutcomeChromeEvent | CompactionStartedChromeEvent | SubagentStartedChromeEvent | PromptAssembledChromeEvent | MemorySavedChromeEvent | WiringManifestChromeEvent | ResultTextDivergedChromeEvent | ResultReplayedChromeEvent | ToolParkedChromeEvent | ApprovalRequestChromeEvent | ApprovalRevokeChromeEvent | {
     kind: 'suspended_reopened';
     laneProof: LaneProof;
     reopen: Extract<SuspendedReopenReading, {
@@ -192,6 +188,7 @@ export interface WiringManifestChromeEvent {
         readonly selected: readonly string[];
     };
     fleet?: WiringManifestFleetView;
+    mods?: readonly WiringManifestModView[];
     eventId?: string;
 }
 export interface TextSegmentCommittedRow {
@@ -232,6 +229,34 @@ export interface CompactionOutcomeChromeEvent {
     outcome: string;
     trigger?: string;
     reason?: string;
+    pass?: string;
+    eventId?: string;
+}
+export interface CompactionStartedChromeEvent {
+    kind: 'compaction_started';
+    laneProof: LaneProof;
+    pass: string;
+    trigger: string;
+    startedAt?: number;
+    eventId?: string;
+}
+export interface SubagentStartedChromeEvent {
+    kind: 'subagent_started';
+    laneProof: LaneProof;
+    taskId: string;
+    sessionId?: string;
+    model?: string;
+    taskType?: string;
+    seq?: number;
+    workflowRunId?: string;
+    workflowAgentLabel?: string;
+    parentTaskId?: string;
+    parentSessionId?: string;
+    rootSessionId?: string;
+    name?: string;
+    spawnName?: string;
+    agentType?: string;
+    startedAt?: number;
     eventId?: string;
 }
 export interface MemorySavedChromeEvent {
@@ -247,6 +272,7 @@ export interface PromptAssembledChromeEvent {
     blocks?: readonly PromptManifestBlockView[];
     sections?: readonly PromptManifestSectionView[];
     tools?: readonly PromptManifestToolView[];
+    identity?: PromptManifestIdentityView;
     eventId?: string;
 }
 export interface ToolDisclosureChromeEvent {
@@ -337,7 +363,9 @@ export interface HumanInputChromeEvent {
     actor?: HumanInputActor;
     entryId?: string;
     eventId?: string;
+    attachments?: HumanInputAttachmentView[];
 }
+export type { HumanInputAttachmentView } from './ownKey.js';
 export interface MessageCommittedChromeEvent {
     kind: 'message_committed';
     laneProof: LaneProof;
@@ -377,3 +405,14 @@ export declare function deriveTranscriptId(frame: {
     id?: unknown;
     toolCallId?: unknown;
 }, ctx: Pick<AdapterContext, 'uuid'>, suffix?: string): string;
+export declare const SEMA_TERMINAL_OWNER_KEY = "_sema_terminal_owner";
+export type TerminalOwner = {
+    readonly kind: 'request-not-sent';
+    readonly requestId?: string;
+    readonly heldBy?: string;
+} | {
+    readonly kind: 'followed-run';
+    readonly taskId: string;
+    readonly runId?: string;
+};
+export declare function terminalOwnerOf(row: {} | null | undefined): TerminalOwner | undefined;