@sema-agent/core 5.13.0 → 5.14.0

package/dist/core/runner/prepare-task.js

@@ -12,6 +12,8 @@ import { primaryActivityArg } from "../arg-summary.js";
 import { materializeMcpTools } from "../mcp.js";
 import { materializeA2aTools } from "../a2a.js";
 import { Type } from "typebox";
+import { Value } from "typebox/value";
+import { uuidv7 } from "../../engine/session/uuid.js";
 import { brainToRuntime } from "../runtime.js";
 import { StoredSession, isSessionConflict, hasSessionFork } from "../session.js";
 import { createSubagentWorktreeHelper, forkGovernanceDenial } from "../../agents/subagent.js";
@@ -24,7 +26,7 @@ import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentList
 import { inlineUntrusted } from "../untrusted-text.js";
 import { emitTrace } from "../trace.js";
 import { createSessionRulePolicy } from "./session-rule-policy.js";
-import { cloneObserverInput, formatHookFeedback, runToolGate } from "../hooks.js";
+import { cloneObserverInput, createHookEnvCapabilities, formatHookFeedback, runToolGate } from "../hooks.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
@@ -64,7 +66,7 @@ import { createMonitorTool } from "../../tools/monitor.js";
 import { createWorktreeTools } from "../../tools/worktree.js";
 import { applyCompactionToReadFileState, bashReversibilityProbe, createHandsToolkit, isReadDedupStubResult, seedReadFileStateFromContext, seedReadFileStateFromTranscript, HAND_TOOL_EFFECTS, pdfModelCapabilitiesOf } from "../../tools/fs/index.js";
 import { decodeTextBytes } from "../../tools/fs/encoding.js";
-import { ASK_USER_QUESTION_TOOL_NAME, createAskUserQuestionTool } from "../ask-question.js";
+import { ASK_USER_QUESTION_TOOL_NAME, createAskUserQuestionTool, classifyQuestionOutcome, isLiveQuestionFace, validateAskQuestions, } from "../ask-question.js";
 import { createSchedulerTools } from "../../tools/scheduler-tools.js";
 import { createPresentPlanTool, createEnterPlanModeTool, PRESENT_PLAN_TOOL_NAME, ENTER_PLAN_MODE_TOOL_NAME } from "../present-plan-tool.js";
 import { isSelfOrchestrationActive, selfOrchestrationFailClosedReason } from "../../orchestration/workflow-script-runner.js";
@@ -73,8 +75,9 @@ import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-
 import { createLspTool, gitCheckIgnoreFilter, resolveLspPath } from "../lsp.js";
 import { resolveKey } from "../../tools/fs/safety.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
-import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, remainingBudgetMicroUsd, } from "../checkpoint-store.js";
+import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, remainingBudgetMicroUsd, resolveCheckpointStore, } from "../checkpoint-store.js";
 import { boundInputHashOf } from "../canonical-json.js";
+import { countElicitOptIns, deriveAskEffective, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam } from "../wiring-manifest.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
 const RECONCILE_MAX_RETRIES = 3;
 const DEFAULT_MAX_SUSPENDS = 5;
@@ -177,11 +180,7 @@ export const DEFAULT_IRREVERSIBLE_SCOPE = "irreversible";
 export function checkpointScopeOf(spec) {
     return spec.durableApproval?.scope || spec.principal || DEFAULT_IRREVERSIBLE_SCOPE;
 }
-export function resolveCheckpointStore(spec, deps) {
-    if (spec.checkpointStore === null)
-        return undefined;
-    return spec.checkpointStore ?? deps.checkpointStore;
-}
+export { resolveCheckpointStore } from "../checkpoint-store.js";
 export function isFableFamilyModelId(id) {
     const tail = id.toLowerCase().split("/").pop() ?? "";
     return /^claude-fable-\d/.test(tail) || /^claude-mythos-5(?!\d)/.test(tail);
@@ -351,6 +350,54 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             { name: "toolResultStore", store: deps.toolResultStore },
         ],
     });
+    const resolvedInteractionPosture = spec.interactionPosture ?? internals?.parentInteractionPosture ?? deps.interactionPosture;
+    {
+        const interactionPosture = resolvedInteractionPosture;
+        const discloseInteractionPostureRefusal = (err) => {
+            try {
+                deps.onError?.(err, { phase: "config", sessionId: spec.sessionId ?? "(pre-session)", classification: "interaction-posture-refused" });
+            }
+            catch {
+            }
+        };
+        if (interactionPosture !== undefined && interactionPosture !== "interactive" && interactionPosture !== "headless") {
+            const e = new Error(`interactionPosture ${JSON.stringify(interactionPosture)} is not a recognized posture ("interactive" | "headless") — ` +
+                `an unevaluable declaration is refused loudly, never folded to either posture.`);
+            e.code = "config.interaction_posture";
+            discloseInteractionPostureRefusal(e);
+            throw e;
+        }
+        if (interactionPosture === "interactive") {
+            const askDoor = resolveAskSeamForm(spec, deps);
+            const humanReachable = deriveAskEffective(askDoor.form, "unresolved") === "human_reachable";
+            const questionDoor = resolveQuestionSeam(spec, deps);
+            const strippedByEngine = internals?.questionFaceStripped === true;
+            if (spec.interactiveTools === false) {
+                const e = new Error(`interaction posture "interactive" declared together with interactiveTools: false — the hard-headless ` +
+                    `clamp removes the AskUserQuestion mount, so no content question can ever reach the human this posture ` +
+                    `promises. Drop one of the two declarations.`);
+                e.code = "config.interaction_posture";
+                discloseInteractionPostureRefusal(e);
+                throw e;
+            }
+            if (!humanReachable || !(questionDoor.wired || strippedByEngine)) {
+                const missing = [];
+                if (!humanReachable) {
+                    missing.push(askDoor.form === "absent"
+                        ? "no onAsk approver is wired (spec.onAsk ?? deps.onAsk is absent — asks would auto-deny or park)"
+                        : `the resolved onAsk seat is the blanket policy "${askDoor.form}" (${askDoor.provenance ?? "?"}) — a policy setting is not a reachable human`);
+                }
+                if (!questionDoor.wired && !strippedByEngine) {
+                    missing.push("no content-question channel (spec.onQuestion ?? deps.onQuestion is absent, and this leg is not an engine-stripped background lane)");
+                }
+                const e = new Error(`interaction posture "interactive" declared, but this assembly cannot reach a human: ${missing.join("; ")}. ` +
+                    `Wire the missing seam(s), or drop the posture declaration (absent = no check).`);
+                e.code = "config.interaction_posture";
+                discloseInteractionPostureRefusal(e);
+                throw e;
+            }
+        }
+    }
     resolveTaskLimits(spec.limits);
     if (spec.resourceSuspend !== undefined) {
         const rsus = spec.resourceSuspend;
@@ -392,6 +439,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const egressTools = new Set();
     const irreversibleTools = new Set();
     const irreversibilityTier = new Map();
+    const axisExplicitNegatives = new Map();
     const reversibilityProbes = new Map();
     let shellGatedBash = false;
     let shellGatedMonitor = false;
@@ -958,9 +1006,20 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const seedAdmittedOrg = seedInheritedGate?.admittedOrgScopes;
         const inheritedAdmittedOrgScopes = liveAdmittedOrg === undefined ? seedAdmittedOrg : seedAdmittedOrg === undefined ? liveAdmittedOrg : liveAdmittedOrg.filter((s) => seedAdmittedOrg.includes(s));
         const inheritedOrgGoverned = liveInheritedGate?.orgAdmissionGoverned === true || seedInheritedGate?.orgAdmissionGoverned === true;
-        const priorOwnOrgVerdict = resume?.seed.inheritedGate?.ownAdmittedOrgScopes !== undefined
+        const checkpointOwnOrgVerdict = resume?.seed.inheritedGate?.ownAdmittedOrgScopes !== undefined
             ? { scopes: resume.seed.inheritedGate.ownAdmittedOrgScopes, writeScope: resume.seed.inheritedGate.ownAdmittedOrgWriteScope ?? null }
             : undefined;
+        const refOwnOrgVerdict = internals?.ownOrgAdmissionRef?.current;
+        const priorOwnOrgVerdict = checkpointOwnOrgVerdict === undefined
+            ? refOwnOrgVerdict
+            : refOwnOrgVerdict === undefined
+                ? checkpointOwnOrgVerdict
+                : {
+                    scopes: checkpointOwnOrgVerdict.scopes.filter((sc) => refOwnOrgVerdict.scopes.includes(sc)),
+                    writeScope: checkpointOwnOrgVerdict.writeScope !== null && checkpointOwnOrgVerdict.writeScope === refOwnOrgVerdict.writeScope
+                        ? checkpointOwnOrgVerdict.writeScope
+                        : null,
+                };
         const orgGovernedProvenance = deps.memoryScopeAdmission !== undefined ||
             (deps.deploymentMemoryScopes !== undefined && deps.deploymentMemoryScopes.length > 0) ||
             deps.compliancePostureResolver !== undefined ||
@@ -1055,6 +1114,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 : {}),
             sessionId,
             ...(spec.backgroundScope !== undefined ? { backgroundScope: spec.backgroundScope } : {}),
+            ...(resolvedInteractionPosture !== undefined ? { interactionPosture: resolvedInteractionPosture } : {}),
             ...(deps.onBackgroundChildEvent ? { onBackgroundChildEvent: deps.onBackgroundChildEvent } : {}),
             ...(internals?.onTaskNotification ? { onTaskNotification: internals.onTaskNotification } : {}),
             ...(forwardEvent ? { forwardEvent } : {}),
@@ -1208,6 +1268,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(spec.getApiKeyAndHeaders !== undefined ? { parentGetApiKeyAndHeaders: spec.getApiKeyAndHeaders } : {}),
                 principal: spec.principal,
                 oneShot: spec.oneShot,
+                ...(resolvedInteractionPosture !== undefined ? { parentInteractionPosture: resolvedInteractionPosture } : {}),
+                autoModeReview: () => (autoModeDecider !== undefined ? { decider: autoModeDecider } : undefined),
                 workflowDepth: internals?.workflowDepth,
                 parentCwd: taskRootPath,
                 parentThinking: () => harnessRef.current?.getThinkingLevel() ?? thinking,
@@ -1380,6 +1442,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     irreversibilityTier.set(axis.name, "always");
                     irreversibleTools.add(axis.name);
                 }
+                if (axis.irreversibility === "never") {
+                    axisExplicitNegatives.set(axis.name, { ...axisExplicitNegatives.get(axis.name), irreversible: false });
+                }
+                if (axis.egress === false) {
+                    axisExplicitNegatives.set(axis.name, { ...axisExplicitNegatives.get(axis.name), egress: false });
+                }
                 if (axis.egress) {
                     if (axis.effect !== undefined && axis.effect !== "write") {
                         const e = new Error(`${protocolLabel} tool "${axis.name}" resolves to egress:true with effect:"${axis.effect}" — an egress tool (external write) must have effect:"write". Clear egress (toolAxes egress:false) if it is a pure read, or set effect:"write".`);
@@ -1535,6 +1603,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
             tools.push(...band.map((t) => firstPartyOffload(t)));
             const shellGate = effectiveShellGate;
+            if (shellGate === "off" && !(executionEnv instanceof StubExecutionEnv) && spec.handsReadOnly !== true) {
+                deps.onError?.(new Error(`shell gate doctrine is "off" while a real writable shell (Bash) is mounted — no shell safety-axis ` +
+                    `fold applies to this run (commands are adjudicated by the ordinary policy/hook chain only). ` +
+                    `Set spec.shellGate to "classify" or "always" if this deployment expects doctrine-gated shell behavior.`), { phase: "config", sessionId, classification: "shell-gate-off" });
+            }
             if (shellGate !== "off" && !(executionEnv instanceof StubExecutionEnv) && spec.handsReadOnly !== true) {
                 shellGatedBash = !egressTools.has("Bash") && !irreversibilityTier.has("Bash");
                 irreversibilityTier.set("Bash", shellGate === "always" ? "always" : "maybe");
@@ -1655,10 +1728,79 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         if (offloadStore)
             tools.push(createReadToolResultTool(offloadStore));
         const onQuestion = frozenOnQuestion;
+        const liveQuestionFace = isLiveQuestionFace(onQuestion) ? onQuestion : undefined;
+        const contentAskBindings = new Map();
+        const CONTENT_ASK_BINDING_CAP = 32;
+        const contentAskRoutable = (toolCallId) => liveQuestionFace !== undefined &&
+            mountedQuestionTool !== undefined &&
+            tools.includes(mountedQuestionTool) &&
+            runtimeCaps?.forceDurableGate !== true &&
+            !inheritedUnavailableAsks.has(toolCallId);
+        const lateStrandedAnswers = [];
+        const discloseStrandedAnswers = (records, why) => {
+            if (records.length === 0)
+                return;
+            try {
+                deps.onError?.(new Error(`AskUserQuestion: ${records.length} question(s) were answered by a person but the call never ` +
+                    `executed to collect the answer (${records.map((r) => `${r.toolCallId} [delivery ${r.deliveryId}]`).join(", ")}) — ${why}. The answer(s) were NOT ` +
+                    `delivered to the model and are gone with this leg; re-ask if the decision is still needed.`), { phase: "degraded", sessionId, classification: "unconsumed-human-answer" });
+            }
+            catch {
+            }
+        };
+        const settleContentAskBindings = () => {
+            const stranded = [];
+            for (const [callId, bound] of contentAskBindings) {
+                if (bound.kind === "answered")
+                    stranded.push({ deliveryId: bound.deliveryId, toolCallId: callId });
+            }
+            contentAskBindings.clear();
+            discloseStrandedAnswers(stranded, "the leg ended first (abort, batch teardown, or a loop failure)");
+            const byDelivery = new Map();
+            for (const r of [...stranded, ...lateStrandedAnswers])
+                byDelivery.set(r.deliveryId, r);
+            return [...byDelivery.values()];
+        };
         const durableQuestionFace = resolveCheckpointStore(spec, deps) !== undefined &&
             (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true);
-        if (spec.interactiveTools === true || (spec.interactiveTools !== false && (onQuestion !== undefined || durableQuestionFace)))
-            tools.push(createAskUserQuestionTool(onQuestion, { principal: spec.principal, sourceTaskId: sessionId }));
+        const mountedQuestionFace = liveQuestionFace !== undefined
+            ? async (req, signal) => {
+                const bound = contentAskBindings.get(req.toolCallId);
+                if (bound !== undefined) {
+                    if (bound.questionsHash === boundInputHashOf(req.questions)) {
+                        contentAskBindings.delete(req.toolCallId);
+                        if (bound.kind === "answered")
+                            return bound.answer;
+                        throw bound.error;
+                    }
+                    contentAskBindings.delete(req.toolCallId);
+                }
+                return liveQuestionFace(req, signal);
+            }
+            : onQuestion;
+        const questionToolMounted = spec.interactiveTools === true || (spec.interactiveTools !== false && (onQuestion !== undefined || durableQuestionFace));
+        let mountedQuestionTool;
+        if (questionToolMounted)
+            tools.push((mountedQuestionTool =
+                createAskUserQuestionTool(mountedQuestionFace, { principal: spec.principal, sourceTaskId: sessionId }, {
+                    ...(resume?.redeemedContentAskCallId !== undefined
+                        ? {
+                            redeemedApprovalCallId: resume.redeemedContentAskCallId,
+                            ...(resume.redeemedContentAskQuestionsHash !== undefined ? { redeemedApprovalQuestionsHash: resume.redeemedContentAskQuestionsHash } : {}),
+                        }
+                        : {}),
+                    ...(resolvedInteractionPosture !== undefined ? { posture: resolvedInteractionPosture } : {}),
+                    ...(spec.interactiveQuestionFallback === true ? { interactiveFallback: true } : {}),
+                    onSyntheticContinuation: ({ questionId, reason }) => {
+                        deps.onError?.(new Error(`AskUserQuestion ${questionId}: no human answer was obtainable (` +
+                            (reason === "seam_absent"
+                                ? "no onQuestion seam is wired"
+                                : reason === "declined_unavailable"
+                                    ? "the wired question channel reported nobody was reachable"
+                                    : "the wired question channel failed") +
+                            `) — the model was instructed to self-answer and the run CONTINUES (warning, not a failure).`), { phase: "degraded", sessionId, classification: "no-human-autoanswered" });
+                    },
+                })));
         if (spec.handsReadOnly !== true) {
             const sessionScope = sessionId ?? spec.principal ?? spec.taskId ?? "default";
             tools.push(...createSchedulerTools(executionEnv, {
@@ -1721,6 +1863,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         });
         memoryAdmittedOrgScopesRef.current = memoryAdmittedOrgScopes;
         ownOrgVerdictRef.current = memoryOwnOrgVerdict ?? priorOwnOrgVerdict;
+        if (internals?.ownOrgAdmissionRef !== undefined && ownOrgVerdictRef.current !== undefined) {
+            internals.ownOrgAdmissionRef.current = ownOrgVerdictRef.current;
+        }
         let memoryBlock = memoryBlockFromEngine;
         if (memorySeedFiles?.length && seedContextFiles) {
             try {
@@ -2117,6 +2262,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             model,
             deferNames: (toolFaceSnapshot.defer ?? []).filter((n) => tools.some((t) => t.name === n)),
             alwaysLoadNames: [
+                ASK_USER_QUESTION_TOOL_NAME,
                 ...(toolFaceSnapshot.alwaysLoad ?? []),
                 ...mcp.tools
                     .filter((t) => t.mcpAlwaysLoad === true && !(toolFaceSnapshot.defer ?? []).includes(t.name))
@@ -2598,6 +2744,15 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ? { sourceAgentName: internals?.explicitAgentName ?? internals?.agentName }
                 : {}),
         });
+        const riskAxesOf = (toolName) => {
+            const tier = irreversibilityTier.get(toolName);
+            const negatives = axisExplicitNegatives.get(toolName);
+            const irreversible = tier === "always" || tier === "maybe" ? true : tier === "never" ? false : negatives?.irreversible;
+            const egress = egressTools.has(toolName) ? true : negatives?.egress;
+            if (irreversible === undefined && egress === undefined)
+                return {};
+            return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
+        };
         const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal) => {
             let editArgs = edit;
             for (let round = 0;; round++) {
@@ -2630,6 +2785,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     args: editArgs,
                     message: re.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                     ...askSourceIdentity(),
+                    ...riskAxesOf(creq.toolName),
                     ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                 }, onAskOf, csignal ?? abortController.signal);
                 if (rr.action !== "allow")
@@ -2654,8 +2810,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         return first;
                     if (first.action === "allow")
                         return { action: "allow" };
-                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME)
+                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
                         return first;
+                    }
                     if (pc.durableMandate === true) {
                         if (resolveCheckpointStore(spec, deps) !== undefined &&
                             (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
@@ -2676,6 +2833,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         args: presentedArgs,
                         message: first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
+                        ...riskAxesOf(creq.toolName),
                         ...(first.action === "ask" && first.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     }, pc.onAsk, csignal ?? abortController.signal);
                     const askWaitMs = Math.max(0, now() - askT0);
@@ -2710,8 +2868,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                     if (decision.action !== "ask")
                         return decision;
-                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME)
+                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
                         return decision;
+                    }
                     if (pc.durableMandate === true) {
                         if (resolveCheckpointStore(spec, deps) !== undefined &&
                             (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
@@ -2732,6 +2891,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         args: presentedArgs,
                         message: decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
+                        ...riskAxesOf(creq.toolName),
                         ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     }, pc.onAsk, csignal ?? abortController.signal);
                     const askWaitMs = Math.max(0, now() - askT0);
@@ -2917,6 +3077,42 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             };
         })();
         const platformSuspendArmed = durableSuspendInfraReady && (envLifetimeSuspendAt !== undefined || usageGovernance !== undefined);
+        const checkpointStore = resolveCheckpointStore(spec, deps);
+        const durableApproval = spec.durableApproval ??
+            (runtimeCaps?.forceDurableGate ? { scope: spec.principal || DEFAULT_IRREVERSIBLE_SCOPE } : undefined);
+        const wiringQuestionSeam = resolveQuestionSeam(spec, deps);
+        const wiringQuestionStripped = internals?.questionFaceStripped === true;
+        const wiringAskSeam = resolveAskSeamForm(spec, deps);
+        const wiringManifest = deriveWiringManifest({
+            half: "effective",
+            leg: resume !== undefined ? "resume" : internals?.isDelegatedChild === true ? "child" : "root",
+            askForm: wiringAskSeam.form,
+            ...(wiringAskSeam.provenance !== undefined ? { askProvenance: wiringAskSeam.provenance } : {}),
+            questionWired: wiringQuestionSeam.wired,
+            ...(wiringQuestionSeam.provenance !== undefined ? { questionProvenance: wiringQuestionSeam.provenance } : {}),
+            ...(wiringQuestionStripped ? { questionStrippedByEngine: true } : {}),
+            ...(resolvedInteractionPosture !== undefined ? { interactionPosture: resolvedInteractionPosture } : {}),
+            ...(spec.interactiveTools === true && !wiringQuestionSeam.wired && !durableQuestionFace && !wiringQuestionStripped
+                ? { interactiveToolsWithoutDeliveryFace: true }
+                : {}),
+            elicitSeamWired: resolveElicitSeam(deps),
+            elicitServersOptedIn: countElicitOptIns(spec),
+            parkCapable: checkpointStore !== undefined,
+            parkDurableApprovalOptIn: spec.durableApproval !== undefined,
+            parkForceDurableGate: runtimeCaps?.forceDurableGate === true,
+            parkSafetyVocabularyArmed: irreversibleTools.size > 0 || egressTools.size > 0,
+            ...(checkpointStore !== undefined ? { checkpointDurability: resolveDeclaredDurability(checkpointStore, "checkpointStore") } : {}),
+            sessionDurability: resolveDeclaredDurability(sessions, "sessionStore"),
+            backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
+            hostChildEventSinkWired: deps.onBackgroundChildEvent !== undefined,
+            lockedConfigWired: deps.lockedConfig !== undefined,
+            complianceWired: deps.compliancePostureResolver !== undefined,
+            memoryAdmissionWired: deps.memoryScopeAdmission !== undefined,
+            retentionPolicyWired: deps.retentionPolicy !== undefined,
+        });
+        const parkLaneArmed = wiringManifest.parkLane.effective === true;
+        const hookContextConsumerWired = hooks?.preToolUse !== undefined || hooks?.postToolUse !== undefined || hooks?.postToolUseFailure !== undefined;
+        const hookEnvFace = hookContextConsumerWired && (ownedEnv ?? deps.executionEnv) != null ? createHookEnvCapabilities(executionEnv) : undefined;
         if (effectivePolicy || hooks?.preToolUse || egressTools.size > 0 || irreversibleTools.size > 0 || resourceSuspendEligible || platformSuspendArmed || spec.enablePlanMode === true) {
             const adjudicate = effectivePolicy
                 ? (req) => raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot }, abortController.signal)), abortController.signal, () => ({
@@ -2998,6 +3194,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     })(),
                     message: decision.message ?? `approval required for "${req.toolName}"`,
                     ...askSourceIdentity(),
+                    ...riskAxesOf(req.toolName),
                     ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                 }, onAsk, abortController.signal);
                 const waitMs = Math.max(0, now() - t0);
@@ -3037,9 +3234,6 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 catch {
                 }
             };
-            const checkpointStore = resolveCheckpointStore(spec, deps);
-            const durableApproval = spec.durableApproval ??
-                (runtimeCaps?.forceDurableGate ? { scope: spec.principal || DEFAULT_IRREVERSIBLE_SCOPE } : undefined);
             const inFlightSpendMicroUsd = () => {
                 const own = liveSpendRef.get?.().costMicroUsd ?? 0;
                 const seededNested = resume?.seed.nestedStats.costMicroUsd;
@@ -3078,6 +3272,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     return live.length > 0 ? live : undefined;
                 })(),
                 pendingSteer: undefined,
+                pendingSteerQueue: undefined,
                 inheritedGate: (() => {
                     const requiresParentConstraint = (inheritedParentConstraints?.length ?? 0) > 0 || seedInheritedGate?.requiresParentConstraint === true;
                     const parentConstraintCount = (inheritedParentConstraints?.length ?? 0) > 0 ? inheritedParentConstraints.length : seedInheritedGate?.parentConstraintCount;
@@ -3325,12 +3520,92 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     return true;
                 }
                 : undefined;
-            const suspendAsk = checkpointStore && (durableApproval || irreversibleTools.size > 0 || egressTools.size > 0)
-                ? async (req, postHookArgs, safety, approverUnavailable) => {
-                    if (onAsk !== undefined &&
+            const resolveContentAsk = async (req) => {
+                if (!contentAskRoutable(req.toolCallId) || liveQuestionFace === undefined || mountedQuestionTool === undefined) {
+                    return { kind: "unavailable", parkDeclined: false };
+                }
+                const deliveryId = uuidv7();
+                const bindOutcome = (entry, questionsHash) => {
+                    if (contentAskBindings.size >= CONTENT_ASK_BINDING_CAP && !contentAskBindings.has(req.toolCallId))
+                        return;
+                    contentAskBindings.set(req.toolCallId, { ...entry, questionsHash, deliveryId });
+                };
+                const refuseBeforeDelivery = (code, presentedInput) => ({
+                    kind: "delivery_failure",
+                    code,
+                    ...(presentedInput !== undefined ? { presentedInput } : {}),
+                });
+                let retained;
+                let presented;
+                try {
+                    retained = structuredClone(req.args);
+                    presented = structuredClone(retained.questions);
+                }
+                catch {
+                    return refuseBeforeDelivery("question.malformed_request");
+                }
+                const retainedQuestionsHash = boundInputHashOf(retained.questions);
+                if (!Value.Check(mountedQuestionTool.parameters, retained) || validateAskQuestions(presented) !== undefined) {
+                    return refuseBeforeDelivery("question.malformed_request", retained);
+                }
+                if (contentAskBindings.size >= CONTENT_ASK_BINDING_CAP && !contentAskBindings.has(req.toolCallId)) {
+                    return { kind: "unavailable", parkDeclined: true };
+                }
+                if (abortController.signal.aborted) {
+                    return { kind: "delivery_failure", code: "question.aborted", presentedInput: retained };
+                }
+                try {
+                    const facePromise = (async () => liveQuestionFace({
+                        toolCallId: req.toolCallId,
+                        questions: presented,
+                        ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
+                        sourceTaskId: sessionId,
+                        boundInputHash: boundInputHashOf(retained),
+                        deliveryId,
+                    }, abortController.signal))();
+                    const settlement = await raceAbort(facePromise.then((outcome) => ({ tag: "outcome", outcome }), (error) => ({ tag: "threw", error })), abortController.signal, () => ({ tag: "aborted" }));
+                    if (settlement.tag === "aborted") {
+                        void facePromise.then((late) => {
+                            if (classifyQuestionOutcome(late).shape !== "answered")
+                                return;
+                            lateStrandedAnswers.push({ deliveryId, toolCallId: req.toolCallId });
+                            discloseStrandedAnswers([{ deliveryId, toolCallId: req.toolCallId }], "the task had already ended when the answer arrived");
+                        }, () => undefined).catch(() => undefined);
+                    }
+                    if (settlement.tag === "outcome") {
+                        const outcome = settlement.outcome;
+                        const reading = classifyQuestionOutcome(outcome);
+                        if (reading.shape === "contradictory") {
+                            bindOutcome({ kind: "failed", error: new Error("the question channel returned a contradictory outcome (an unavailable answer)") }, retainedQuestionsHash);
+                            return { kind: "delivery_failure", code: "question.human_channel_failed", presentedInput: retained };
+                        }
+                        if (reading.shape === "unavailable")
+                            return { kind: "unavailable", parkDeclined: true, presentedInput: retained };
+                        const answerSnapshot = reading.answer;
+                        bindOutcome({ kind: "answered", answer: answerSnapshot }, retainedQuestionsHash);
+                        return { kind: "answered", presentedInput: retained };
+                    }
+                    const error = settlement.tag === "threw"
+                        ? settlement.error
+                        : Object.assign(new Error("the task ended while this question was still out"), { name: "AbortError" });
+                    bindOutcome({ kind: "failed", error }, retainedQuestionsHash);
+                    return {
+                        kind: "delivery_failure",
+                        code: settlement.tag === "aborted" || abortController.signal.aborted ? "question.aborted" : "question.human_channel_failed",
+                        presentedInput: retained,
+                    };
+                }
+                catch (err) {
+                    bindOutcome({ kind: "failed", error: err }, retainedQuestionsHash);
+                    return { kind: "delivery_failure", code: "question.human_channel_failed", presentedInput: retained };
+                }
+            };
+            const suspendAsk = parkLaneArmed && checkpointStore !== undefined
+                ? async (req, postHookArgs, safety, liveFaceUnavailable) => {
+                    const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : onAsk !== undefined;
+                    if (syncFirstEligible &&
                         runtimeCaps?.forceDurableGate !== true &&
-                        approverUnavailable !== true &&
-                        req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
+                        liveFaceUnavailable !== true &&
                         !inheritedUnavailableAsks.has(req.toolCallId)) {
                         return undefined;
                     }
@@ -3519,9 +3794,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: spec.taskId ?? sessionId, site: f.site, message: f.error.message, ts: Date.now() })),
                             event: e,
                             preToolUse: hooks?.preToolUse,
+                            ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
                             adjudicate,
                             resolveAsk: resolveAskBound,
                             suspendAsk,
+                            resolveContentAsk,
                             egress: egressTools.has(e.toolName),
                             irreversibility: irreversibilityTier.get(e.toolName),
                             reversibilityProbe: reversibilityProbes.get(e.toolName),
@@ -3574,7 +3851,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             isInterrupt: abortController.signal.aborted || spec.signal?.aborted === true,
                             content: e.content.map((c) => ({ ...c })),
                             details: clonedDetails,
-                        }, { toolCallId: e.toolCallId, toolName: e.toolName });
+                        }, { toolCallId: e.toolCallId, toolName: e.toolName, ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}) });
                         if (patch?.additionalContext) {
                             content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext) }];
                             changed = true;
@@ -3582,7 +3859,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                 }
                 else if (hooks?.postToolUse) {
-                    const patch = await hooks.postToolUse(e.toolName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: e.toolName });
+                    const patch = await hooks.postToolUse(e.toolName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: e.toolName, ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}) });
                     if (patch?.updatedOutput) {
                         content = patch.updatedOutput;
                         changed = true;
@@ -3831,7 +4108,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             : undefined;
         overheadState.promptChars = systemPrompt.length;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), releaseSignal, cacheBreakDetector, cacheFingerprint, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.d.ts

@@ -1,5 +1,5 @@
-import type { Model } from "../../internal/llm.js";
-import { type Checkpoint, type CheckpointToken, type ReopenReason, type ResumeOutcome } from "../checkpoint-store.js";
+import { type Model } from "../../internal/llm.js";
+import { type Checkpoint, type CheckpointToken, type PendingSteerEntry, type ReopenReason, type ResumeOutcome } from "../checkpoint-store.js";
 import type { RunInternals } from "./prepare-task.js";
 import { type TaskOutcome } from "../task-outcome.js";
 import { type SideQuerySpec, type SideQueryResult } from "../side-query.js";
@@ -13,10 +13,7 @@ interface ResumeRun {
     outcome: Extract<ResumeOutcome, {
         gate: "policy_ask" | "resource_limit" | "dry_run_review" | "plan_review" | "wake";
     }>;
-    wakeMessage?: {
-        text: string;
-        trusted: boolean;
-    };
+    wakeMessage?: Omit<PendingSteerEntry, "seq">;
     onEnvRestoreFailed?: (reason: ReopenReason) => Promise<void>;
     decisionDelivered?: boolean;
 }