@sema-agent/core 2.13.0 → 4.0.0

package/dist/core/memory-engine/scope-contract.js

@@ -1,5 +1,11 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+import { canonicalize } from "./layout.js";
+function pathSegmentsDualFamily(p) {
+    return p.split(/[\\/]/).filter(Boolean);
+}
+const CASE_INSENSITIVE_FS = process.platform === "darwin" || process.platform === "win32";
+const foldPathCase = (s) => (CASE_INSENSITIVE_FS ? s.toLowerCase() : s);
 export const SCOPE_SEGMENT_MAX_ENCODED = 64;
 const SEGMENT_SAFE = /^[A-Za-z0-9._-]$/;
 export function encodeScopeSegment(raw) {
@@ -117,9 +123,9 @@ export function assertScopeContractPlacement(args) {
     const personal = args.parsedScopes.filter(isCentralAuthorityScope);
     if (personal.length === 0)
         return;
-    const root = resolve(args.repoRoot);
-    const dir = resolve(args.memoryDir);
-    if (dir === root || dir.startsWith(root + "/")) {
+    const rootSegs = pathSegmentsDualFamily(canonicalize(resolve(args.repoRoot))).map(foldPathCase);
+    const dirSegs = pathSegmentsDualFamily(canonicalize(resolve(args.memoryDir))).map(foldPathCase);
+    if (rootSegs.length <= dirSegs.length && rootSegs.every((s, i) => s === dirSegs[i])) {
         const e = new Error(`memory scope contract v2: central-authority scope(s) ${personal
             .map((p) => `"${p.kind}"`)
             .join(", ")} cannot materialize into an IN-REPO memory dir (${args.memoryDir}) — ` +

package/dist/core/memory-engine/types.d.ts

@@ -88,7 +88,7 @@ export interface MemorySessionHandle {
     indexBaselineLines: number;
     indexText: string;
 }
-export type HarvestRejectionCode = "outside_root" | "symlink" | "secret" | "injection" | "filename" | "too_large" | "file_cap" | "readonly_layer" | "stub_modified" | "nested_too_deep" | "quarantine_failed" | "invalid";
+export type HarvestRejectionCode = "outside_root" | "symlink" | "secret" | "injection" | "filename" | "too_large" | "file_cap" | "readonly_layer" | "stub_modified" | "nested_too_deep" | "quarantine_failed" | "unreadable" | "invalid";
 export interface HarvestRejection {
     path: string;
     code: HarvestRejectionCode;

package/dist/core/memory.js

@@ -32,6 +32,9 @@ const SECRET_PATTERNS = [
     { label: "slack_token", re: /\bxox[baprs]-(?:[A-Za-z0-9]+-){1,3}[A-Za-z0-9]{16,}\b/ },
     { label: "google_api_key", re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
     { label: "private_key", re: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/ },
+    { label: "jwt", re: /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{16,}\b/ },
+    { label: "azure_storage_account_key", re: /AccountKey=[A-Za-z0-9+/]{40,}={0,2}/ },
+    { label: "bearer_token", re: /\bAuthorization:\s*Bearer\s+(?=[A-Za-z0-9._~+/-]*[0-9])[A-Za-z0-9._~+/-]{20,}=*/ },
 ];
 export function detectSecret(text) {
     if (!text)

package/dist/core/permission-rules.d.ts

@@ -11,7 +11,7 @@ export interface ParsedPermissionRule {
 }
 export interface PermissionRuleIssue {
     rule: string;
-    code: "invalid.empty_tool" | "invalid.paren" | "invalid.param_split" | "invalid.allow_param_rule" | "invalid.primary_field" | "invalid.cap_exceeded" | "unsupported.bash_prefix" | "unsupported.file_glob" | "unsupported.mcp_paren";
+    code: "invalid.empty_tool" | "invalid.paren" | "invalid.param_split" | "invalid.allow_param_rule" | "invalid.primary_field" | "invalid.cap_exceeded" | "unsupported.bash_prefix" | "unsupported.file_glob" | "unsupported.mcp_paren" | "unsupported.unknown_param";
     message: string;
 }
 export interface PermissionRuleCaps {
@@ -30,5 +30,6 @@ export interface PermissionRulePolicyOptions {
 }
 export declare function parsePermissionRule(rule: string): ParsedPermissionRule;
 export declare function wildcardMatch(pattern: string, value: string): boolean;
+export declare const fileToolParamVocabulary: (canonicalTool: string) => ReadonlySet<string> | undefined;
 export declare function validatePermissionRules(rules: PermissionRule[], opts?: Pick<PermissionRulePolicyOptions, "primaryFieldGeneric" | "caps">): PermissionRuleIssue[];
 export declare function createPermissionRulePolicy(rules: PermissionRule[], opts?: PermissionRulePolicyOptions): ToolPolicy;

package/dist/core/permission-rules.js

@@ -90,6 +90,18 @@ const PRIMARY_FIELDS = {
     WebSearch: new Set(["query"]),
 };
 const FILE_TOOLS = new Set(["Read", "Edit", "Write", "MultiEdit", "NotebookEdit", "Grep", "Glob"]);
+const FILE_TOOL_PARAMS = {
+    Read: new Set(["file_path", "path", "offset", "limit", "pages"]),
+    Edit: new Set(["file_path", "path", "old_string", "new_string", "replace_all"]),
+    Write: new Set(["file_path", "path", "content"]),
+    NotebookEdit: new Set(["notebook_path", "path", "cell_id", "cell_type", "edit_mode", "new_source"]),
+    Grep: new Set([
+        "pattern", "path", "glob", "type", "output_mode", "head_limit", "max_results", "offset",
+        "multiline", "context", "ignore_case", "-i", "-n", "-o", "-A", "-B", "-C",
+    ]),
+    Glob: new Set(["pattern", "path", "max_results"]),
+};
+export const fileToolParamVocabulary = (canonicalTool) => FILE_TOOL_PARAMS[canonicalTool];
 function countStars(s) {
     let n = 0;
     for (const c of s)
@@ -151,9 +163,18 @@ function compile(rules, caps, primaryFieldGeneric) {
                 continue;
             }
         }
-        else if (FILE_TOOLS.has(toolName) && colon <= 0) {
-            bad(text, "unsupported.file_glob", "file-tool glob rules (`Edit(src/**)`) are the tool-specific lane — not supported by the generic param DSL");
-            continue;
+        else if (FILE_TOOLS.has(toolName)) {
+            if (colon <= 0) {
+                bad(text, "unsupported.file_glob", "file-tool glob rules (`Edit(src/**)`) are the tool-specific lane — not supported by the generic param DSL");
+                continue;
+            }
+            const paramPart = content.slice(0, colon).trim();
+            const vocabulary = FILE_TOOL_PARAMS[toolName];
+            if (vocabulary !== undefined && !vocabulary.has(paramPart)) {
+                bad(text, "unsupported.unknown_param", `"${paramPart}" is not a parameter of ${toolName} (it carries ${[...vocabulary].sort().join(", ")}) — the rule would compile and never match. ` +
+                    `For a path glob use the tool-specific lane (\`${toolName}(src/**)\` is not the generic param DSL); a Windows path such as \`${toolName}(C:/foo)\` parses as the param "C".`);
+                continue;
+            }
         }
         if (colon <= 0) {
             bad(text, "invalid.param_split", "param-level ruleContent must be `param:pattern`");

package/dist/core/runner/active-skill-scope.d.ts

@@ -16,7 +16,6 @@ export declare class ActiveSkillScope {
     active(): readonly ActiveSkillFrame[];
     get size(): number;
 }
-export declare function isWithin(root: string, p: string): boolean;
 export declare function createActiveSkillScopePolicy(opts: {
     scope: ActiveSkillScope;
     env: ExecutionEnv;

package/dist/core/runner/active-skill-scope.js

@@ -1,4 +1,5 @@
 import { canonicalizeTarget, fileArgPath } from "../../tools/fs/safety.js";
+import { PATH_WRITE_TOOLS, isWithin } from "./session-rule-policy.js";
 import { canonicalToolName } from "../tool-name-aliases.js";
 import { parseSkillToolEntry, skillSpecifierRejection } from "../skill-tool-specifier.js";
 export class ActiveSkillScope {
@@ -16,21 +17,6 @@ export class ActiveSkillScope {
         return this.frames.length;
     }
 }
-const PATH_WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit"]);
-export function isWithin(root, p) {
-    const norm = (x) => {
-        let n = x.replace(/\\/g, "/");
-        if (/^[A-Za-z]:(\/|$)/.test(n))
-            n = n[0].toLowerCase() + n.slice(1);
-        return n;
-    };
-    const r = norm(root);
-    const c = norm(p);
-    if (c === r)
-        return true;
-    const base = r.endsWith("/") ? r : r + "/";
-    return c.startsWith(base);
-}
 export function createActiveSkillScopePolicy(opts) {
     const { scope, env, rootPath, toolEffects } = opts;
     return {

package/dist/core/runner/assemble-result.d.ts

@@ -1,5 +1,5 @@
 import type { AssistantMessage } from "../../internal/llm.js";
-import type { TaskResult, TaskSpec } from "../types.js";
+import type { NestedUsage, TaskResult, TaskSpec } from "../types.js";
 export interface Stats {
     turns: number;
     tokens: number;
@@ -10,14 +10,9 @@ export interface Stats {
     cacheWriteTokensLong: number;
     outputTokens: number;
     cacheHitRate?: number;
-    totalInputTokens?: number;
+    totalInputTokens: number;
     costMicroUsd: number;
-    nested?: {
-        tokens: number;
-        turns: number;
-        tasks: number;
-        costMicroUsd?: number;
-    };
+    nested?: NestedUsage;
     memory?: {
         tokens: number;
         costMicroUsd: number;

package/dist/core/runner/assemble-result.js

@@ -1,5 +1,4 @@
-import { DEGENERATE_MESSAGE } from "../../brain/repetition.js";
-import { WALLTIME_CUTOFF_MESSAGE } from "../../brain/walltime.js";
+import { isDegenerateCutMessage, isWalltimeCutMessage } from "../../brain/terminal-cause.js";
 import { extractErrorCode, stripErrorCodePrefix } from "../../brain/errors.js";
 export function errorCodeOf(err) {
     let cur = err;
@@ -35,7 +34,6 @@ function assistantText(msg) {
 export function assembleResult(spec, sessionId, final, stats, flags) {
     const taskId = spec.taskId ?? sessionId;
     const text = final ? assistantText(final) : "";
-    stats.totalInputTokens = stats.promptTokens;
     if (!flags.unpricedSpend) {
         const compactionMicroUsd = stats.compactionMicroUsd ?? 0;
         const nestedSubagentMicroUsd = stats.nested?.costMicroUsd ?? 0;
@@ -55,8 +53,8 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     let checkpointToken;
     let checkpointGate;
     let workspaceRestoreMode;
-    const isDegenerate = final?.stopReason === "error" && final.errorMessage === DEGENERATE_MESSAGE;
-    const isWalltimeCutoff = final?.stopReason === "error" && final.errorMessage === WALLTIME_CUTOFF_MESSAGE;
+    const isDegenerate = final?.stopReason === "error" && isDegenerateCutMessage(final);
+    const isWalltimeCutoff = final?.stopReason === "error" && isWalltimeCutMessage(final);
     if (flags.outputInvalid) {
         status = "failed";
         errorCode = "output.invalid";

package/dist/core/runner/compaction-call-options.d.ts

@@ -0,0 +1,7 @@
+import { type TracerHook } from "../trace.js";
+import type { MaybeCompactOptions } from "../auto-compaction.js";
+import type { TaskSpec } from "../types.js";
+import type { Prepared } from "./prepare-task.js";
+export declare function buildWorkingFileAttachments(spec: TaskSpec, prepared: Prepared): MaybeCompactOptions["workingFileAttachments"];
+export declare function centerAdoptionOption(prepared: Prepared): Partial<Pick<MaybeCompactOptions, "centerAdoption">>;
+export declare function emitInputTruncated(tracer: TracerHook | undefined, taskId: string): NonNullable<MaybeCompactOptions["onInputTruncated"]>;

package/dist/core/runner/compaction-call-options.js

@@ -0,0 +1,30 @@
+import { emitTrace } from "../trace.js";
+export function buildWorkingFileAttachments(spec, prepared) {
+    if (spec.compaction?.attachWorkingFiles === false || !prepared.readTaskFile)
+        return undefined;
+    return {
+        readFile: prepared.readTaskFile,
+        ...(prepared.recentlyReadFiles ? { recentlyReadFiles: prepared.recentlyReadFiles } : {}),
+        ...(prepared.normalizeAttachmentPath ? { normalizePath: prepared.normalizeAttachmentPath } : {}),
+        ...(prepared.isDedupStubResult ? { isDedupStubResult: prepared.isDedupStubResult } : {}),
+        ...(prepared.instructionSources
+            ? { instructionSourcePaths: prepared.instructionSources.filter((s) => s.contentHash !== null).map((s) => s.path) }
+            : {}),
+        ...(typeof spec.compaction?.attachWorkingFiles === "object" ? spec.compaction.attachWorkingFiles : undefined),
+    };
+}
+export function centerAdoptionOption(prepared) {
+    const ca = prepared.centerCompactionCandidate?.();
+    return ca !== undefined ? { centerAdoption: ca } : {};
+}
+export function emitInputTruncated(tracer, taskId) {
+    return (info) => emitTrace(tracer, () => ({
+        kind: "compaction.input_truncated",
+        version: 1,
+        taskId,
+        label: info.label,
+        droppedChars: info.droppedChars,
+        keptChars: info.keptChars,
+        ts: Date.now(),
+    }));
+}

package/dist/core/runner/prepare-task.d.ts

@@ -12,12 +12,13 @@ import type { SessionPermissionRules } from "../session-policy-store.js";
 import { CacheBreakDetector, type ToolFingerprintInput } from "../cache-break-detector.js";
 import { type OutputRef, type BlockedRef, type SkillListingEntry } from "./synthetic-tools.js";
 import type { MemoryEngine } from "../memory-engine/engine.js";
+import { type ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
 import type { TaskNotificationPayload } from "../task-notification.js";
 import { type CwdRef } from "../../tools/fs/index.js";
 import type { Runner } from "./runtask.js";
 import { type CheckpointGate, type CheckpointState, type CheckpointToken, type ResourceLedger, type ResourceLimitReason } from "../checkpoint-store.js";
-import type { AgentMessage, AgentTool, ExecutionEnv } from "../../internal/harness.js";
-import type { RunnerDeps, TaskEvent, TaskResult, TaskSpec, ToolActivity, ToolEffect } from "../types.js";
+import type { ActiveWorktreeSession, AgentMessage, AgentTool, ExecutionEnv } from "../../internal/harness.js";
+import type { NestedUsageAccum, RunnerDeps, TaskEvent, TaskResult, TaskSpec, ToolActivity, ToolEffect } from "../types.js";
 import type { RepairBundle } from "../../agents/repair-loop.js";
 export declare const DEFAULT_IRREVERSIBLE_SCOPE = "irreversible";
 export declare function checkpointScopeOf(spec: {
@@ -42,21 +43,11 @@ export interface Prepared {
         hit: boolean;
     };
     blockedToolCalls: Set<string>;
-    nestedStats: {
-        tokens: number;
-        turns: number;
-        tasks: number;
-        costMicroUsd: number;
-    };
+    nestedStats: NestedUsageAccum;
     rewindNotes?: NonNullable<TaskResult["rewindNotes"]>;
     cwdRef?: CwdRef;
     worktreeSessionRef?: {
-        current?: {
-            worktreeDir: string;
-            originalCwd: string;
-            baseSha: string;
-            entered?: boolean;
-        };
+        current?: ActiveWorktreeSession;
     };
     workspaceStateSettle?: {
         rootCanonical: string;
@@ -89,15 +80,7 @@ export interface Prepared {
             hash: string;
             contentHash?: string;
         }>;
-        tools?: Array<{
-            wireName: string;
-            aliases: string[];
-            contractId: string;
-            implementationRevision: string;
-            cardId: string;
-            shapeDigest: string;
-            wireSchemaDigest: string;
-        }>;
+        tools?: ToolManifestRow[];
         snapshot?: {
             cacheIdentity: string;
             elements: import("../../prompt-assembly/turn-snapshot.js").CacheIdentityElements;

package/dist/core/runner/prepare-task.js

@@ -31,7 +31,7 @@ import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
 import { defineTool, isDefineToolProduct } from "../tools.js";
 import { canonicalToolName } from "../tool-name-aliases.js";
 import { pathToUri } from "../lsp-protocol.js";
-import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, buildToolResultRef, firstPartyOffloadPolicy, InMemoryToolResultStore, RunnerSharedToolResultStore, ScopedToolResultStore, isVolatileOffloadStore, OFFLOAD_TOOL_NAME, createReadToolResultTool, withToolResultOffload, } from "../tool-result-store.js";
+import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, createOffloadPersist, firstPartyOffloadPolicy, InMemoryToolResultStore, RunnerSharedToolResultStore, ScopedToolResultStore, isVolatileOffloadStore, OFFLOAD_TOOL_NAME, createReadToolResultTool, withToolResultOffload, } from "../tool-result-store.js";
 import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createOutputTool, createReportBlockedTool, createReportFindingsTool, createSkillTool, normalizeSkills } from "./synthetic-tools.js";
 import { compileOutputSchema } from "./strict-output-schema.js";
 import { TOOL_SEARCH_NAME, buildDeferredRegistry, classifyDeferred, extractDiscoveredToolNames, createPlaceholderTool, createToolSearchTool, } from "./tool-disclosure.js";
@@ -51,6 +51,7 @@ import { dropOrphanToolResults, guardBudget, insertTrimNotice, trimToBudget } fr
 import { StubExecutionEnv } from "../stub-env.js";
 import { hasDestroy, isIsolated, isRemoteExecutionEnv, isRetryableRemoteErrorCode, isSuspendable, missingRestoreSurface, RETRYABLE_REMOTE_ERROR_CODES } from "../remote-env.js";
 import { withRetry } from "../with-retry.js";
+import { settleTeardownLeg } from "./teardown-bounded.js";
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
 import { createTaskOutputTool, createTaskStopTool, defaultTaskRegistry } from "../task-registry.js";
 import { createMonitorTool } from "../../tools/monitor.js";
@@ -62,7 +63,7 @@ import { createSchedulerTools } from "../../tools/scheduler-tools.js";
 import { createPresentPlanTool, createEnterPlanModeTool, PRESENT_PLAN_TOOL_NAME, ENTER_PLAN_MODE_TOOL_NAME } from "../present-plan-tool.js";
 import { isSelfOrchestrationActive, selfOrchestrationFailClosedReason } from "../../orchestration/workflow-script-runner.js";
 import { createRunWorkflowTool, RUN_WORKFLOW_TOOL_NAME } from "../../orchestration/run-workflow-tool.js";
-import { createLspTool, gitCheckIgnoreFilter } from "../lsp.js";
+import { createLspTool, gitCheckIgnoreFilter, resolveLspPath } from "../lsp.js";
 import { resolveKey } from "../../tools/fs/safety.js";
 import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, RESOURCE_CHECKPOINT_VERSION, WALLTIME_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, remainingBudgetMicroUsd, } from "../checkpoint-store.js";
 import { boundInputHashOf } from "../canonical-json.js";
@@ -433,24 +434,30 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     }
     const taskScope = internals?.registryScope ?? spec.principal ?? "default";
     const offloadScope = spec.principal ?? "default";
+    if (internals?.registryScope !== undefined && internals.registryScope !== offloadScope) {
+        deps.onError?.(new Error(`offload/tool-result namespace note: this run mounts in registry domain "${internals.registryScope}" but its offloaded tool results live under the TRUST identity "${offloadScope}" (principal${spec.principal === undefined ? " absent → default" : ""}). Before 2.13.0 the registry domain named this namespace too; if a deployment used registryScope as its ref-tenancy boundary, that boundary is now the principal — pass one, or read refs under "${offloadScope}".`), { phase: "config", sessionId });
+    }
     defaultTaskRegistry.maybeGc();
     const forgetOnThrow = () => forgetQuietly(sessions, sessionId);
     const extraBodyCollisions = reservedCollisions(model.extraBody, reservedFor(model.api));
     if (extraBodyCollisions.length > 0) {
         deps.onError?.(new Error(`model.extraBody contains reserved key(s) [${extraBodyCollisions.join(", ")}] that core owns and sets itself — they are ignored. Remove them from extraBody.`), { phase: "config", sessionId });
     }
-    const nestedStats = { tokens: 0, turns: 0, tasks: 0, costMicroUsd: 0 };
+    const nestedStats = { tokens: 0, turns: 0, tasks: 0, costMicroUsd: 0, anyUnpriced: false };
     if (resume) {
         nestedStats.tokens = resume.seed.nestedStats.tokens;
         nestedStats.turns = resume.seed.nestedStats.turns;
         nestedStats.tasks = resume.seed.nestedStats.tasks;
         nestedStats.costMicroUsd = resume.seed.nestedStats.costMicroUsd;
+        nestedStats.anyUnpriced = resume.seed.nestedStats.anyUnpriced ?? true;
     }
     const reportUsage = (u) => {
         nestedStats.tokens += u.tokens;
         nestedStats.turns += u.turns;
         nestedStats.tasks += u.tasks;
         nestedStats.costMicroUsd += u.costMicroUsd ?? 0;
+        if (u.costMicroUsd === undefined)
+            nestedStats.anyUnpriced = true;
     };
     const explicitGlobalThreshold = spec.toolResultThresholdChars ?? deps.toolResultThresholdChars;
     const offloadThreshold = explicitGlobalThreshold ?? DEFAULT_TOOL_RESULT_THRESHOLD_CHARS;
@@ -479,13 +486,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     if (offloadStore && (spec.tools ?? []).some((t) => t.name === OFFLOAD_TOOL_NAME)) {
         const e = new Error(`Tool name "${OFFLOAD_TOOL_NAME}" is reserved when large-result offload is enabled.`);
         e.code = "config.reserved_tool_name";
-        await forgetOnThrow();
+        await settleTeardownLeg(() => forgetOnThrow(), "forgetOnThrow (reserved-name leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
         throw e;
     }
     let ownedEnv;
     let mcp;
     if (internals?.requestedCwd !== undefined && deps.executionEnvFactory === undefined) {
-        await forgetOnThrow();
+        await settleTeardownLeg(() => forgetOnThrow(), "forgetOnThrow (cwd-unsupported leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
         const e = new Error(`Agent cwd "${internals.requestedCwd}" cannot take effect: this deployment has no executionEnvFactory (a static execution environment cannot be re-rooted per agent). Drop the cwd parameter or deploy a factory.`);
         e.code = "config.cwd_unsupported";
         throw e;
@@ -501,7 +508,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             : undefined;
     }
     catch (factoryErr) {
-        await forgetOnThrow();
+        await settleTeardownLeg(() => forgetOnThrow(), "forgetOnThrow (env-factory-throw leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
         throw factoryErr;
     }
     const executionEnv = ownedEnv ?? deps.executionEnv ?? new StubExecutionEnv();
@@ -512,13 +519,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         };
         const want = await canon(internals.requestedCwd);
         const rejectCwd = async (message, code) => {
-            await forgetOnThrow();
-            try {
-                if (ownedEnv && hasDestroy(ownedEnv))
-                    await ownedEnv.destroy();
-            }
-            catch {
-            }
+            await settleTeardownLeg(() => forgetOnThrow(), "forgetOnThrow (cwd-reject leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
+            await settleTeardownLeg(() => (ownedEnv && hasDestroy(ownedEnv) ? ownedEnv.destroy() : undefined), "ownedEnv.destroy (cwd-reject leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
             const e = new Error(message);
             e.code = code;
             throw e;
@@ -1400,6 +1402,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(internals?.onTaskNotification !== undefined ? { onTaskNotification: internals.onTaskNotification } : {}),
                 ...(handsCwdRef !== undefined ? { cwdRef: handsCwdRef } : {}),
                 ...(offloadStore !== undefined ? { toolResultStore: offloadStore } : {}),
+                ...(spec.retainBackgroundProcesses === true ? { retainBackgroundProcesses: true } : {}),
             })));
         }
         if (handsCwdRef !== undefined) {
@@ -1463,30 +1466,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const nudgeLspOnEdit = lspDiagnostics
             ? (rawPath) => {
                 const baseDir = handsCwdRef?.current ?? taskRootPath;
-                const isAbsForm = rawPath.startsWith("/") || /^[A-Za-z]:[\\/]/.test(rawPath);
-                const joinSep = baseDir.includes("\\") ? "\\" : "/";
-                const normalizeSegments = (pth) => {
-                    const isUnc = pth.startsWith("\\\\");
-                    const drive = /^[A-Za-z]:/.exec(pth)?.[0] ?? "";
-                    const rest = pth.slice(drive.length + (isUnc ? 2 : 0));
-                    const sep = pth.includes("\\") ? "\\" : "/";
-                    const abs = rest.startsWith("/") || rest.startsWith("\\");
-                    const outSegs = [];
-                    for (const seg of rest.split(/[\\/]+/)) {
-                        if (!seg || seg === ".")
-                            continue;
-                        if (seg === "..") {
-                            if (outSegs.length > 0 && outSegs[outSegs.length - 1] !== "..")
-                                outSegs.pop();
-                            else if (!abs)
-                                outSegs.push("..");
-                            continue;
-                        }
-                        outSegs.push(seg);
-                    }
-                    return (isUnc ? sep + sep : "") + drive + (abs ? sep : "") + outSegs.join(sep);
-                };
-                const filePath = normalizeSegments(isAbsForm ? rawPath : baseDir.replace(/[\\/]+$/, "") + joinSep + rawPath);
+                const filePath = resolveLspPath(rawPath, baseDir);
                 lspDiagnostics.fileEdited(pathToUri(filePath));
                 void lspManager
                     .sessionFor(filePath, undefined, executionEnv)
@@ -2743,6 +2723,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                 }
                 : undefined;
+            const notifyHookError = (err) => {
+                try {
+                    deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId });
+                }
+                catch {
+                }
+            };
             const checkpointStore = spec.checkpointStore ?? deps.checkpointStore;
             const durableApproval = spec.durableApproval ??
                 (runtimeCaps?.forceDurableGate ? { scope: spec.principal || DEFAULT_IRREVERSIBLE_SCOPE } : undefined);
@@ -3183,6 +3170,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             reversibilityProbe: reversibilityProbes.get(e.toolName),
                             abortSignal: abortController.signal,
                             ...(notifyPermissionDenied ? { permissionDenied: notifyPermissionDenied } : {}),
+                            onHookError: notifyHookError,
                             shellGated: (e.toolName === "Bash" && shellGatedBash) || (e.toolName === "Monitor" && shellGatedMonitor),
                             ...(autoModeDecider ? { autoMode: { decider: autoModeDecider } } : {}),
                             isMarkedUnresolvable: (toolCallId) => inheritedUnavailableAsks.has(toolCallId),
@@ -3285,11 +3273,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(offloadStore
                     ? {
                         offload: {
-                            persist: (toolCallId, fullText) => {
-                                const ref = buildToolResultRef(sessionId, toolCallId);
-                                void offloadStore.put(ref, fullText);
-                                return ref;
-                            },
+                            persist: createOffloadPersist(offloadStore, sessionId),
                         },
                     }
                     : {}),
@@ -3490,20 +3474,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     }
     catch (prepareErr) {
         if (mcp) {
-            try {
-                await mcp.dispose();
-            }
-            catch {
-            }
+            const mcpHandle = mcp;
+            await settleTeardownLeg(() => mcpHandle.dispose(), "mcp.dispose (prepare-throw leg)", (e) => deps.onError?.(e, { phase: "config", sessionId }));
         }
         if (ownedEnv && hasDestroy(ownedEnv)) {
-            try {
-                await ownedEnv.destroy();
-            }
-            catch {
-            }
+            const env = ownedEnv;
+            await settleTeardownLeg(() => env.destroy(), "ownedEnv.destroy (prepare-throw leg)", (e) => deps.onError?.(e, { phase: "config", sessionId }));
         }
-        await forgetOnThrow();
+        await settleTeardownLeg(() => forgetOnThrow(), "forgetOnThrow (prepare-throw leg)", (e) => deps.onError?.(e, { phase: "config", sessionId }));
         throw prepareErr;
     }
 }

package/dist/core/runner/runtask.d.ts

@@ -19,6 +19,7 @@ interface ResumeRun {
         trusted: boolean;
     };
     onEnvRestoreFailed?: (reason: ReopenReason) => Promise<void>;
+    decisionDelivered?: boolean;
 }
 export declare class Runner {
     private deps;