@sema-agent/core 5.13.0 → 5.14.0

package/dist/core/runner/runtask.js

@@ -1,10 +1,12 @@
 import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, uuidv7 } from "../../internal/harness.js";
-import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, MAX_SUPPORTED_CHECKPOINT_VERSION, remainingBudgetMicroUsd, remainingTokens, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
+import { snapshotActorAssertion } from "../../internal/llm.js";
+import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, MAX_SUPPORTED_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
 import { engineVersion } from "../version.js";
 import { CONFIG_CATALOG_VERSION, declarationReasons, resolveEffectiveConfig } from "../../config/catalog.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
 import { DEFAULT_COMPACTION_INSTRUCTIONS, createRapidRefillState, isCompactionManualCancel, maybeCompact, nextTrimForceBackoff, recordCompactionAndCheckRapidRefill, sanitizeCompactionSettings } from "../auto-compaction.js";
-import { ASK_USER_QUESTION_TOOL_NAME, QUESTION_AWAITS_RESUME } from "../ask-question.js";
+import { ASK_USER_QUESTION_TOOL_NAME, canonicalizeCapturedPlainData, classifyQuestionOutcome, isLiveQuestionFace, markBoundOnlyQuestionFace } from "../ask-question.js";
+import { boundInputHashOf } from "../canonical-json.js";
 import { computeCostMicroUsd, modelCostToPricing } from "../pricing.js";
 import { emitTrace } from "../trace.js";
 import { emitTaskOutcome } from "../task-outcome.js";
@@ -31,6 +33,7 @@ import { hasVerifiableStructureSignal } from "./grounding-signal.js";
 import { hasDestroy, isIsolated } from "../remote-env.js";
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
 import { formatHookFeedback } from "../hooks.js";
+import { buildHumanInputEvent, projectHumanInput } from "../human-input-projection.js";
 import { delimitUntrusted, inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
@@ -52,6 +55,15 @@ function createRunState() {
         attach: { attachmentsCfg: undefined, agentListingOn: false, skillsListingOn: false, attachState: undefined, dateState: undefined, instrProbe: undefined, instrState: undefined, sizeGuidelineState: undefined, attachmentsInjected: 0 },
     };
 }
+const humanInputOrdinals = new WeakMap();
+function nextHumanInputSeq(key) {
+    let box = humanInputOrdinals.get(key);
+    if (box === undefined) {
+        box = { n: 0 };
+        humanInputOrdinals.set(key, box);
+    }
+    return ++box.n;
+}
 const MAX_CONSECUTIVE_COMPACTION_FAILURES = 3;
 const STOP_HOOK_BLOCK_CAP = 8;
 const COMPACTION_REGROWTH_FACTOR = 1.5;
@@ -139,7 +151,15 @@ function deepJsonEqual(a, b) {
     if (aArr && bArr) {
         if (a.length !== b.length)
             return false;
-        return a.every((v, i) => deepJsonEqual(v, b[i]));
+        for (let i = 0; i < a.length; i++) {
+            if (!deepJsonEqual(a[i], b[i]))
+                return false;
+        }
+        const aExtra = Object.keys(a).filter((k) => !isCanonicalIndexKey(k, a.length));
+        const bExtra = Object.keys(b).filter((k) => !isCanonicalIndexKey(k, b.length));
+        if (aExtra.length !== bExtra.length)
+            return false;
+        return aExtra.every((k) => Object.prototype.hasOwnProperty.call(b, k) && deepJsonEqual(Reflect.get(a, k), Reflect.get(b, k)));
     }
     const ao = a;
     const bo = b;
@@ -149,6 +169,9 @@ function deepJsonEqual(a, b) {
         return false;
     return aKeys.every((k) => Object.prototype.hasOwnProperty.call(bo, k) && deepJsonEqual(ao[k], bo[k]));
 }
+function isCanonicalIndexKey(key, length) {
+    return /^(0|[1-9]\d*)$/.test(key) && Number(key) < length;
+}
 function sameWinner(a, b) {
     return (a.boundCallId === b.boundCallId &&
         a.decision === b.decision &&
@@ -160,14 +183,18 @@ function pendingContentAskCallId(cp) {
         ? cp.pendingAction.toolCallId
         : undefined;
 }
-function answerFaceForRedeemedCall(answer, redeemedCallId, base) {
-    return async (req, signal) => {
-        if (req.toolCallId === redeemedCallId)
+function answerFaceForRedeemedCall(answer, redeemedCallId, base, redeemedQuestionsHash) {
+    let consumed = false;
+    const face = async (req, signal) => {
+        if (!consumed && req.toolCallId === redeemedCallId && boundInputHashOf(req.questions) === redeemedQuestionsHash) {
+            consumed = true;
             return answer;
+        }
         if (base !== undefined)
             return base(req, signal);
         throw new Error("this resumed leg's answer was bound to the decided question only — a new question has no answer on this leg");
     };
+    return isLiveQuestionFace(base) ? face : markBoundOnlyQuestionFace(face);
 }
 function writeFamilyOfCanonical(name) {
     if (name === "TaskCreate" || name === "TaskUpdate")
@@ -1166,6 +1193,7 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
             const progress = {
                 type: "task_progress",
                 taskId: rs.telemetry.taskId,
+                ...(internals?.delegationTaskType !== undefined ? { taskType: internals.delegationTaskType } : {}),
                 ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
                 ...(subagentName ? { name: subagentName } : {}),
                 usage: { totalTokens: stats.tokens, toolUses: stats.toolCalls, durationMs: Date.now() - rs.telemetry.taskStart },
@@ -1332,6 +1360,7 @@ export class Runner {
         return runSideQuery(spec, { brain: this.deps.brain, models: this.deps.models, roles: this.deps.roles });
     }
     runTaskStream(spec, resume, internals) {
+        const entryActor = spec.actor === undefined ? undefined : snapshotActorAssertion(spec.actor);
         const queue = new PushQueue();
         const detachHub = new ToolDetachHub();
         let resultValue;
@@ -1386,7 +1415,7 @@ export class Runner {
                     publishReady(h);
                 }, (s) => {
                     reapHandle = s;
-                }, manualCompactRef, taskIdRef, resume, { ...(internals ?? {}), detachHub }, notifyRef);
+                }, manualCompactRef, taskIdRef, resume, { ...(internals ?? {}), detachHub }, notifyRef, entryActor);
             }
             finally {
                 releaseLock?.();
@@ -1523,7 +1552,29 @@ export class Runner {
                 if (options?.trusted && sanitizeUntrustedText(text) !== text) {
                     throw steeringError("trusted steering text must not contain a </system-reminder> tag", "steering.invalid_content");
                 }
-                const payload = options?.trusted ? formatHookFeedback(text) : text;
+                const actor = options?.actor === undefined ? undefined : snapshotActorAssertion(options.actor);
+                const projected = projectHumanInput({ text, actor, source: "steer" });
+                const payload = options?.trusted ? formatHookFeedback(projected) : projected;
+                const mintsAFrame = payload.trim().length !== 0;
+                const emitAccepted = (h) => {
+                    if (!mintsAFrame)
+                        return;
+                    queue.push({
+                        ...buildHumanInputEvent({
+                            carrier: "steer",
+                            source: "steer",
+                            delivery: "queued",
+                            sessionSeq: nextHumanInputSeq(h.harness),
+                            ...(actor !== undefined ? { actor } : {}),
+                            ...(actor?.issuer !== undefined ? { issuer: actor.issuer } : {}),
+                            ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
+                        }),
+                        eventId: uuidv7(),
+                        ...(internals?.parentToolCallId !== undefined
+                            ? { parentToolCallId: internals.parentToolCallId, ...(spec.taskId !== undefined ? { sourceTaskId: spec.taskId } : {}) }
+                            : {}),
+                    });
+                };
                 const deliver = async () => {
                     if (resultValue)
                         throw steeringError("the task has already finished");
@@ -1531,7 +1582,8 @@ export class Runner {
                     if (!h)
                         throw steeringError("the task is not running");
                     try {
-                        await h.harness.steer(payload, { provenance: "engine-note" });
+                        await h.harness.steer(payload, { provenance: "engine-note", ...(actor !== undefined ? { actor } : {}) });
+                        emitAccepted(h);
                         return;
                     }
                     catch (e) {
@@ -1541,7 +1593,8 @@ export class Runner {
                     const birthDeadline = Date.now() + READY_TIMEOUT_MS;
                     while (resultValue === undefined && !h.loop.ended && Date.now() < birthDeadline) {
                         try {
-                            await h.harness.steer(payload, { provenance: "engine-note" });
+                            await h.harness.steer(payload, { provenance: "engine-note", ...(actor !== undefined ? { actor } : {}) });
+                            emitAccepted(h);
                             return;
                         }
                         catch (e2) {
@@ -1658,7 +1711,7 @@ export class Runner {
             })()),
         };
     }
-    async runLocked(spec, queue, setResult, onSuggestions, onReady, onSuspend, manualCompactRef, taskIdRef, resume, internals, notifyRef) {
+    async runLocked(spec, queue, setResult, onSuggestions, onReady, onSuspend, manualCompactRef, taskIdRef, resume, internals, notifyRef, entryActor) {
         const prepareResume = resume
             ? {
                 leafId: resume.cp.leafId,
@@ -1671,6 +1724,12 @@ export class Runner {
                 executesApprovedAction: resume.cp.pendingAction.kind === "tool_approval" &&
                     resume.outcome.gate !== "wake" &&
                     resume.outcome.decision === "allow",
+                ...(resume.outcome.gate !== "wake" && resume.outcome.decision === "allow" && pendingContentAskCallId(resume.cp) !== undefined
+                    ? {
+                        redeemedContentAskCallId: pendingContentAskCallId(resume.cp),
+                        redeemedContentAskQuestionsHash: boundInputHashOf(resume.cp.pendingAction.args?.questions),
+                    }
+                    : {}),
             }
             : undefined;
         const taskNotificationQueue = new SystemInjectionQueue();
@@ -1759,6 +1818,7 @@ export class Runner {
         const parentToolCallId = internals?.parentToolCallId;
         const ident = () => parentToolCallId !== undefined ? { eventId: uuidv7(), parentToolCallId, sourceTaskId: runSourceTaskId } : { eventId: uuidv7() };
         notificationIdent = ident;
+        queue.push({ type: "wiring_manifest", manifest: prepared.wiringManifest, ...ident() });
         manualCompactRef.emitMooted = (reason) => {
             queue.push({ type: "compaction_outcome", outcome: "mooted", trigger: "manual", reason, ...ident() });
         };
@@ -2595,6 +2655,7 @@ export class Runner {
         let final;
         let threw;
         let abortedLive = false;
+        let strandedHumanAnswers = [];
         try {
             if (prepared.abortController.signal.aborted) {
                 const e = new Error("run aborted");
@@ -2647,15 +2708,31 @@ export class Runner {
                         }
                     }
                     const engineSegments = continuation.length > 0 ? [{ start: 0, end: continuation.length }] : [];
-                    for (const steer of [resume.cp.state.pendingSteer, resume.wakeMessage]) {
-                        if (steer === undefined)
-                            continue;
+                    const resumeFrames = [
+                        ...readPendingSteerQueue(resume.cp.state).map((entry) => ({ entry, source: "steer" })),
+                        ...(resume.wakeMessage !== undefined ? [{ entry: resume.wakeMessage, source: "wake" }] : []),
+                    ];
+                    for (const { entry: steer, source } of resumeFrames) {
                         const start = continuation.length;
+                        const projected = projectHumanInput({ text: steer.text, actor: steer.actor, source });
                         continuation +=
                             "\n\n" +
-                                (steer.trusted ? formatHookFeedback(steer.text) : delimitUntrusted("supervisor steering message", steer.text));
+                                (steer.trusted ? formatHookFeedback(projected) : delimitUntrusted("supervisor steering message", projected));
                         if (steer.trusted)
                             engineSegments.push({ start, end: continuation.length });
+                        queue.push({
+                            ...buildHumanInputEvent({
+                                carrier: source,
+                                source,
+                                delivery: "applied",
+                                sessionSeq: nextHumanInputSeq(prepared.harness),
+                                inputId: steer.inputId,
+                                ...(steer.actor !== undefined ? { actor: steer.actor } : {}),
+                                ...(steer.actor?.issuer !== undefined ? { issuer: steer.actor.issuer } : {}),
+                                ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
+                            }),
+                            ...ident(),
+                        });
                     }
                     if (resume !== undefined)
                         resume.decisionDelivered = true;
@@ -2663,7 +2740,9 @@ export class Runner {
                 }
             }
             else {
-                let effectiveObjective = spec.objective;
+                const objectiveActor = entryActor;
+                const projectedObjective = projectHumanInput({ text: spec.objective, actor: objectiveActor, source: "objective" });
+                let effectiveObjective = projectedObjective;
                 let promptBlocked = false;
                 const userPromptSubmit = (spec.hooks ?? this.deps.hooks)?.userPromptSubmit;
                 if (userPromptSubmit) {
@@ -2674,7 +2753,7 @@ export class Runner {
                             promptBlocked = true;
                         }
                         else if (decision?.additionalContext) {
-                            effectiveObjective = `${formatHookFeedback(decision.additionalContext)}\n\n${spec.objective}`;
+                            effectiveObjective = `${formatHookFeedback(decision.additionalContext)}\n\n${projectedObjective}`;
                         }
                     }
                     catch (hookErr) {
@@ -2775,10 +2854,23 @@ export class Runner {
                     rs.attach.attachmentsInjected += firstFrames.length;
                     if (firstFrames.length > 0)
                         await prepared.session.appendAnnouncedListing(prepared.announcedListingsRef).catch(() => undefined);
-                    const enginePrefixChars = effectiveObjective.length - spec.objective.length;
+                    const enginePrefixChars = effectiveObjective.length - projectedObjective.length;
+                    queue.push({
+                        ...buildHumanInputEvent({
+                            carrier: "objective",
+                            source: "objective",
+                            delivery: "applied",
+                            sessionSeq: nextHumanInputSeq(prepared.harness),
+                            ...(objectiveActor !== undefined ? { actor: objectiveActor } : {}),
+                            ...(objectiveActor?.issuer !== undefined ? { issuer: objectiveActor.issuer } : {}),
+                            ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
+                        }),
+                        ...ident(),
+                    });
                     final = await withBrainSinks(() => prepared.harness.prompt(effectiveObjective, {
                         ...(images && images.length > 0 ? { images } : {}),
                         ...(enginePrefixChars > 0 ? { enginePrefixChars } : {}),
+                        ...(objectiveActor !== undefined ? { actor: objectiveActor } : {}),
                     }));
                 }
             }
@@ -2801,6 +2893,7 @@ export class Runner {
             prepared.lspDiagnostics?.registry.releaseRun(prepared.lspDiagnostics.runIdent);
             prepared.abortController.abort();
             prepared.releaseSignal();
+            strandedHumanAnswers = prepared.settleContentAskBindings();
             try {
                 prepared.harness.recoverUndrainedEngineNotes();
             }
@@ -2939,6 +3032,7 @@ export class Runner {
                 model: prepared.model.id,
                 unpricedSpend: rs.telemetry.unpricedSpend,
                 rewindNotes: prepared.rewindNotes,
+                strandedHumanAnswers,
                 remoteEnvFailures: prepared.remoteEnvFailures,
                 retryAfterMs: rs.limits.platformTerminal?.retryAfterMs,
                 abortedForTimeout: timeout.fired,
@@ -3075,6 +3169,7 @@ export class Runner {
                 const terminalTick = {
                     type: "task_progress",
                     taskId: rs.telemetry.taskId,
+                    ...(internals?.delegationTaskType !== undefined ? { taskType: internals.delegationTaskType } : {}),
                     ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
                     ...(subagentName ? { name: subagentName } : {}),
                     usage: { totalTokens: stats.tokens, toolUses: stats.toolCalls, durationMs: Date.now() - rs.telemetry.taskStart },
@@ -3335,7 +3430,7 @@ export class Runner {
             if (outcome.message !== undefined) {
                 wakeMessage = validatePendingSteer(outcome.message);
             }
-            else if (cp.state.pendingSteer === undefined) {
+            else if (readPendingSteerQueue(cp.state).length === 0) {
                 throw new CheckpointError("wake.nothing_to_deliver", "cannot wake: no message was supplied and the checkpoint holds no parked pendingSteer — an empty " +
                     "wake would burn the checkpoint on a blank continuation; supply `message` or park a steer first");
             }
@@ -3349,8 +3444,7 @@ export class Runner {
         if (!gateMatch) {
             throw new CheckpointError("checkpoint.gate_mismatch", `resume outcome (gate "${outcome.gate}") does not match checkpoint gate "${cp.gate.kind}" — resume serves human/policy_ask, irreversible_ask/policy_ask, resource_limit/resource_limit, needs_review/dry_run_review, and plan_review/plan_review`);
         }
-        const reasonBearing = (outcome.gate === "policy_ask" && outcome.decision === "deny") ||
-            (outcome.gate === "dry_run_review" && outcome.decision === "reject") ||
+        const reasonBearing = (outcome.gate === "dry_run_review" && outcome.decision === "reject") ||
             (outcome.gate === "plan_review" && outcome.decision === "reject");
         if (reasonBearing && outcome.reason && sanitizeUntrustedText(outcome.reason) !== outcome.reason) {
             throw new CheckpointError("checkpoint.invalid_outcome", "resume deny/reject reason must not contain a </system-reminder> tag");
@@ -3374,14 +3468,60 @@ export class Runner {
                 throw new CheckpointError("checkpoint.reopen_revote", "an env_failed reopen replays the ALREADY-RECORDED review decision — refusing a re-vote whose edited plan differs from the recorded one");
             }
         }
-        if (outcome.gate === "policy_ask") {
+        let suppliedAnswer;
+        let redeemedAnswer;
+        let plainPolicyOutcome;
+        if (cp.gate.kind === "human" || cp.gate.kind === "irreversible_ask") {
+            const decide = outcome;
+            suppliedAnswer = decide.answer;
+            if (suppliedAnswer !== undefined) {
+                const reading = classifyQuestionOutcome(suppliedAnswer);
+                if (reading.shape !== "answered") {
+                    throw new CheckpointError("checkpoint.invalid_outcome", "resume carried a content-ask `answer` that does not read as an answer (malformed, sparse, or not capturable as plain data) — " +
+                        "refusing pre-CAS rather than fabricating an empty human response; the checkpoint stays pending", { field: "answer" });
+                }
+                redeemedAnswer = reading.answer;
+            }
+            const updatedInputRaw = decide.updatedInput;
+            let updatedInput;
+            try {
+                updatedInput = updatedInputRaw === undefined ? undefined : structuredClone(updatedInputRaw);
+            }
+            catch {
+                throw new CheckpointError("checkpoint.invalid_outcome", "resume carried an `updatedInput` that could not be captured as plain data — refusing pre-CAS; the checkpoint stays pending");
+            }
+            if (Object.is(updatedInput, -0))
+                updatedInput = 0;
+            if (updatedInput !== undefined && !canonicalizeCapturedPlainData(updatedInput)) {
+                throw new CheckpointError("checkpoint.invalid_outcome", "resume carried an `updatedInput` outside the plain-JSON value domain (a Map/Set/Date/buffer, a sparse or expando-carrying array, a non-finite number, or a cycle) — " +
+                    "such a value reads differently on the two sides of the durable store; refusing pre-CAS, the checkpoint stays pending");
+            }
+            const decision = decide.decision;
+            if (decision !== "allow" && decision !== "deny") {
+                throw new CheckpointError("checkpoint.invalid_outcome", `resume decision "${String(decision)}" is outside the policy_ask domain — a decide is exactly "allow" or "deny"; refusing pre-CAS, the checkpoint stays pending`);
+            }
+            const reason = decide.reason;
+            plainPolicyOutcome = {
+                gate: "policy_ask",
+                boundCallId: decide.boundCallId,
+                boundInputHash: decide.boundInputHash,
+                decision,
+                ...(updatedInput !== undefined ? { updatedInput } : {}),
+                ...(reason !== undefined ? { reason } : {}),
+                ...(redeemedAnswer !== undefined ? { answer: redeemedAnswer } : {}),
+            };
+            if (plainPolicyOutcome.decision === "deny" && plainPolicyOutcome.reason && sanitizeUntrustedText(plainPolicyOutcome.reason) !== plainPolicyOutcome.reason) {
+                throw new CheckpointError("checkpoint.invalid_outcome", "resume deny/reject reason must not contain a </system-reminder> tag");
+            }
+        }
+        if (plainPolicyOutcome !== undefined) {
             const boundTo = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction.toolCallId : undefined;
-            if (outcome.boundCallId !== boundTo) {
-                throw new CheckpointError("checkpoint.invalid_outcome", `resume boundCallId "${outcome.boundCallId}" does not match the checkpoint's pending tool call "${boundTo ?? "(none)"}" — the decision-action binding (design/80 D-1) failed; refusing to apply a decision bound to a different action`, { field: "boundCallId" });
+            if (plainPolicyOutcome.boundCallId !== boundTo) {
+                throw new CheckpointError("checkpoint.invalid_outcome", `resume boundCallId "${plainPolicyOutcome.boundCallId}" does not match the checkpoint's pending tool call "${boundTo ?? "(none)"}" — the decision-action binding (design/80 D-1) failed; refusing to apply a decision bound to a different action`, { field: "boundCallId" });
             }
             const boundHash = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction.boundInputHash : undefined;
             if (boundHash !== undefined) {
-                if (outcome.boundInputHash !== boundHash) {
+                if (plainPolicyOutcome.boundInputHash !== boundHash) {
                     throw new CheckpointError("checkpoint.invalid_outcome", "resume boundInputHash does not match the checkpoint's pending tool call input — the decision-action input binding (design/80 D-1 §2) failed; refusing to apply an approval bound to a different input (TOCTOU re-mint guard)", { field: "boundInputHash" });
                 }
             }
@@ -3392,20 +3532,26 @@ export class Runner {
                 if (cp.resolvedOutcome === undefined) {
                     throw new CheckpointError("checkpoint.reopen_revote", "checkpoint was reopened after an env-restore failure (env_failed) but carries no persisted winner to replay — refusing to resume (inconsistent row, fail-closed)");
                 }
-                const incoming = winnerFromOutcome(outcome);
-                if (incoming === undefined || !sameWinner(incoming, cp.resolvedOutcome)) {
+                const incoming = winnerFromOutcome(plainPolicyOutcome);
+                const persistedWinner = (() => {
+                    const w = cp.resolvedOutcome;
+                    if (w?.answer === undefined)
+                        return w;
+                    const reading = classifyQuestionOutcome(w.answer);
+                    return reading.shape === "answered" ? { ...w, answer: reading.answer } : w;
+                })();
+                if (incoming === undefined || !sameWinner(incoming, persistedWinner)) {
                     throw new CheckpointError("checkpoint.reopen_revote", `this checkpoint was reopened after an env-restore failure (env_failed) — a re-resume is a system retry of the already-approved action, not a re-vote; the supplied decision must replay the persisted winner (boundCallId "${cp.resolvedOutcome.boundCallId}", decision "${cp.resolvedOutcome.decision}"), refusing a different decision`);
                 }
             }
             const contentAskCallId = pendingContentAskCallId(cp);
-            if (outcome.answer !== undefined && (contentAskCallId === undefined || outcome.decision !== "allow")) {
+            if (suppliedAnswer !== undefined && (contentAskCallId === undefined || plainPolicyOutcome.decision !== "allow")) {
                 throw new CheckpointError("checkpoint.invalid_outcome", contentAskCallId === undefined
                     ? "resume carried a content-ask `answer` but the checkpoint's pending call is not the reserved question tool — an answer has no consumer on a side-effecting tool's approval; refusing rather than dropping it silently"
                     : "resume carried a content-ask `answer` on a `deny` — a denial injects a refusal, never an answer; refusing rather than dropping it silently", { field: "answer" });
             }
-            if (contentAskCallId !== undefined && outcome.decision === "allow" && outcome.answer === undefined) {
-                const liveFace = taskConfig.onQuestion ?? this.deps.onQuestion;
-                if (liveFace === undefined || liveFace === QUESTION_AWAITS_RESUME) {
+            if (contentAskCallId !== undefined && plainPolicyOutcome.decision === "allow" && suppliedAnswer === undefined) {
+                if (!isLiveQuestionFace(taskConfig.onQuestion ?? this.deps.onQuestion)) {
                     throw new CheckpointError("checkpoint.invalid_outcome", "resume approved a content-ask (the reserved question tool) without an `answer`, and this resume has no live answering face — " +
                         'executing the question against nothing would hand the model a fabricated "no human is available" default while consuming the approval; ' +
                         "re-resume with the operator's answer on the outcome (or deny it), the checkpoint stays pending", { field: "answer" });
@@ -3442,7 +3588,8 @@ export class Runner {
                     "rejected pre-CAS (the checkpoint stays pending) — re-resume with the full original chain");
             }
         }
-        const won = await store.resolve(token, cp.scope, outcome, { rev: cp.rev ?? 0 });
+        const outcomeForStore = plainPolicyOutcome ?? outcome;
+        const won = await store.resolve(token, cp.scope, outcomeForStore, { rev: cp.rev ?? 0 });
         if (!won) {
             const live = await store.get(token);
             if (live?.status === "pending") {
@@ -3456,8 +3603,8 @@ export class Runner {
             await internals.afterCheckpointResolve();
             consumeFlipDone = true;
         }
-        const answerFace = outcome.gate === "policy_ask" && outcome.answer !== undefined
-            ? answerFaceForRedeemedCall(outcome.answer, outcome.boundCallId, taskConfig.onQuestion ?? this.deps.onQuestion)
+        const answerFace = plainPolicyOutcome !== undefined && redeemedAnswer !== undefined
+            ? answerFaceForRedeemedCall(redeemedAnswer, plainPolicyOutcome.boundCallId, taskConfig.onQuestion ?? this.deps.onQuestion, boundInputHashOf(cp.pendingAction.args?.questions))
             : undefined;
         const spec = {
             ...taskConfig,
@@ -3496,7 +3643,7 @@ export class Runner {
                     ? new CheckpointError("checkpoint.reopen_failed", "the resume was aborted before the approved action could run AND the store refused to reopen the checkpoint — the approval is terminally consumed and the suspended work was not executed; a retry needs a fresh approval")
                     : new CheckpointError("checkpoint.reopen_failed", "the resume was aborted before the approved action could run and the reopen attempt FAILED IN FLIGHT — the checkpoint's state is unprovable from here: it may already be pending again. Re-read it before deciding; do NOT issue a fresh approval on the assumption the old one is dead (the approved action did NOT run either way)");
         }
-        return this.runTaskStream(spec, { cp, outcome, onEnvRestoreFailed, ...(wakeMessage !== undefined ? { wakeMessage } : {}) }, internals);
+        return this.runTaskStream(spec, { cp, outcome: plainPolicyOutcome ?? outcome, onEnvRestoreFailed, ...(wakeMessage !== undefined ? { wakeMessage } : {}) }, internals);
     }
     async applyResumeDecision(prepared, resume, emit, emitCommitted, onResolvedToolSuccess, onExecuteStart) {
         const { pendingAction } = resume.cp;
@@ -3552,7 +3699,7 @@ export class Runner {
         const { outcome } = resume;
         if (pendingAction.kind !== "tool_approval" || outcome.gate !== "policy_ask")
             return;
-        const resolvedArgs = pendingAction.toolName === ASK_USER_QUESTION_TOOL_NAME ? pendingAction.args : (outcome.updatedInput ?? pendingAction.args);
+        const resolvedArgs = pendingAction.toolName === ASK_USER_QUESTION_TOOL_NAME ? pendingAction.args : (outcome.updatedInput !== undefined ? outcome.updatedInput : pendingAction.args);
         const pendingLabel = (() => { const l = prepared.tools.find((t) => t.name === pendingAction.toolName)?.label; return l !== undefined && l !== pendingAction.toolName ? { label: l } : {}; })();
         emit({ type: "tool_start", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, args: resolvedArgs });
         const emitEnd = (isError, result) => emit({ type: "tool_end", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, isError, ...toolEndBodyFrom(result, isError) });
@@ -3563,6 +3710,9 @@ export class Runner {
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);
             return;
         }
+        if (outcome.decision !== "allow") {
+            throw new CheckpointError("checkpoint.invalid_outcome", `pending action reached the resolver with decision "${String(outcome.decision)}" — only "allow" executes and only "deny" injects a denial; refusing to execute`);
+        }
         if (outcome.decision === "allow" && outcome.updatedInput !== undefined && prepared.basePolicyForResumeEdit) {
             const rechecked = refuseOutOfContractDecision(await prepared.basePolicyForResumeEdit.check({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId }, prepared.abortController.signal));
             if (rechecked.action === "deny") {

package/dist/core/runner/tool-output-projection.js

@@ -57,6 +57,7 @@ export const toolOutputFrom = (result) => {
     return { output: raw, truncated: true, totalChars };
 };
 const CC_DETAIL_TYPES = new Set([
+    "ask-question",
     "edit", "create", "update", "bash", "notebook-edit", "notebook", "file_unchanged", "worktree", "text", "grep", "glob", "mcp",
     "agent", "task", "task-list", "task-output", "workflow-run",
     "web-fetch", "web-search", "todo", "cron-create", "cron-delete", "cron-list", "image",

package/dist/core/session-store.d.ts

@@ -1,5 +1,6 @@
 import { type SessionRepo } from "../internal/harness.js";
 import { type AcquiredSession, type SessionStore, type SessionStoreSummary } from "./session.js";
+import type { StoreDurability } from "./checkpoint-store.js";
 import { SESSION_DEFAULT_TTL_DAYS } from "../config/defaults.js";
 export { SESSION_DEFAULT_TTL_DAYS };
 export type EvictPolicy = "delete" | "forget";
@@ -8,9 +9,11 @@ export interface TtlSessionStoreOptions {
     sweepIntervalMs?: number;
     repo?: SessionRepo;
     evict?: EvictPolicy;
+    durability?: StoreDurability;
 }
 export declare class TtlSessionStore implements SessionStore {
     readonly retention: "none";
+    readonly durability?: StoreDurability;
     private repo;
     private entries;
     private owners;

package/dist/core/session-store.js

@@ -5,6 +5,7 @@ import { SESSION_DEFAULT_TTL_DAYS } from "../config/defaults.js";
 export { SESSION_DEFAULT_TTL_DAYS };
 export class TtlSessionStore {
     retention = "none";
+    durability;
     repo;
     entries = new Map();
     owners = new Map();
@@ -15,6 +16,9 @@ export class TtlSessionStore {
     sweepTimer;
     constructor(opts = {}) {
         this.repo = opts.repo ?? new InMemorySessionRepo();
+        const durability = opts.durability ?? (opts.repo === undefined ? "process-local" : undefined);
+        if (durability !== undefined)
+            this.durability = durability;
         this.defaultTtlMs = (opts.defaultTtlDays ?? SESSION_DEFAULT_TTL_DAYS) * DAY_MS;
         this.evictPolicy = opts.evict ?? (opts.repo ? "forget" : "delete");
         if (opts.sweepIntervalMs !== undefined && opts.sweepIntervalMs > 0) {

package/dist/core/session.d.ts

@@ -20,6 +20,7 @@ export interface SessionStoreSummary {
     forkedFrom?: string;
 }
 export interface SessionStore {
+    readonly durability?: import("./checkpoint-store.js").StoreDurability;
     acquire(sessionId?: string, opts?: {
         requireExisting?: boolean;
     }): Promise<AcquiredSession>;

package/dist/core/store-contracts/background-agent-store-contract.js

@@ -52,6 +52,25 @@ export async function backgroundAgentStoreContract(mk, runAssertion) {
         assert.equal(await store.get("a1", "tenant-C"), null, "an unrelated scope must not see the row");
         assert.equal(await store.get("a-missing", S), null);
     });
+    run("the org-admission fields round-trip, and ABSENT stays absent (a backend must not invent a verdict)", async (make) => {
+        const store = make();
+        await store.put(record({ handle: "a1", admittedOrgScopes: ["org:acme", "org:beta"], admittedOrgWriteScope: "org:acme" }));
+        const withVerdict = await held(store, "a1");
+        assert.deepEqual(withVerdict.admittedOrgScopes, ["org:acme", "org:beta"]);
+        assert.equal(withVerdict.admittedOrgWriteScope, "org:acme");
+        await store.put(record({ handle: "a2", admittedOrgScopes: [], admittedOrgWriteScope: null }));
+        const readOnly = await held(store, "a2");
+        assert.deepEqual(readOnly.admittedOrgScopes, []);
+        assert.equal(readOnly.admittedOrgWriteScope, null);
+        await store.put(record({ handle: "a3" }));
+        const untouched = await held(store, "a3");
+        assert.equal(untouched.admittedOrgScopes, undefined);
+        assert.equal(untouched.admittedOrgWriteScope, undefined);
+        await store.update("a3", S, { ...untouched, admittedOrgScopes: ["org:acme"], admittedOrgWriteScope: null }, { rev: untouched.rev });
+        const afterCas = await held(store, "a3");
+        assert.deepEqual(afterCas.admittedOrgScopes, ["org:acme"]);
+        assert.equal(afterCas.admittedOrgWriteScope, null);
+    });
     run("put refuses a scopeless row (a row with no tenant partition would be world-readable)", async (make) => {
         const store = make();
         await assert.rejects(store.put(record({ scope: "" })), "an empty scope must be refused loudly, not stored");

package/dist/core/store-contracts/checkpoint-store-contract.js

@@ -1,5 +1,5 @@
 import { strict as assert } from "node:assert";
-import { mintCheckpointToken, } from "../checkpoint-store.js";
+import { MAX_PENDING_STEER_ENTRIES, mintCheckpointToken, readPendingSteerQueue, } from "../checkpoint-store.js";
 import { beginContract } from "./contract-harness.js";
 export function createCheckpointFixture(over = {}) {
     const token = over.token ?? mintCheckpointToken();
@@ -90,9 +90,68 @@ export async function checkpointStoreContract(make, runAssertion) {
         const cp = createCheckpointFixture();
         await store.put(cp.token, cp);
         await assert.rejects(store.setPendingSteer(cp.token, cp.scope, { text: "</SYSTEM-REMINDER>", trusted: true }), (e) => e.code === "steering.invalid_content");
-        assert.equal((await store.get(cp.token)).state.pendingSteer, undefined);
+        assert.deepEqual(readPendingSteerQueue((await store.get(cp.token)).state), []);
         assert.equal(await store.setPendingSteer(cp.token, cp.scope, { text: "go", trusted: false }), true);
-        assert.deepEqual((await store.get(cp.token)).state.pendingSteer, { text: "go", trusted: false });
+        const q = readPendingSteerQueue((await store.get(cp.token)).state);
+        assert.equal(q.length, 1);
+        assert.equal(q[0].text, "go");
+        assert.equal(q[0].trusted, false);
+        assert.equal(q[0].seq, 1);
+        assert.equal((await store.get(cp.token)).state.pendingSteer, undefined);
+    });
+    run("setPendingSteer APPENDS: two steers both survive in issue order, each keeping its frozen trust", async () => {
+        const store = make();
+        const cp = createCheckpointFixture();
+        await store.put(cp.token, cp);
+        assert.equal(await store.setPendingSteer(cp.token, cp.scope, { text: "first", trusted: false }), true);
+        assert.equal(await store.setPendingSteer(cp.token, cp.scope, { text: "second", trusted: true }), true);
+        const q = readPendingSteerQueue((await store.get(cp.token)).state);
+        assert.deepEqual(q.map((e) => e.text), ["first", "second"]);
+        assert.deepEqual(q.map((e) => e.trusted), [false, true]);
+        assert.deepEqual(q.map((e) => e.seq), [1, 2]);
+    });
+    run("setPendingSteer is idempotent on inputId (a retry with the caller's own message id adds nothing)", async () => {
+        const store = make();
+        const cp = createCheckpointFixture();
+        await store.put(cp.token, cp);
+        assert.equal(await store.setPendingSteer(cp.token, cp.scope, { text: "once", trusted: false, inputId: "m1" }), true);
+        assert.equal(await store.setPendingSteer(cp.token, cp.scope, { text: "once", trusted: false, inputId: "m1" }), true);
+        assert.equal(readPendingSteerQueue((await store.get(cp.token)).state).length, 1);
+    });
+    run("the queue bound is fail-loud steering.queue_full and evicts nothing", async () => {
+        const store = make();
+        const cp = createCheckpointFixture();
+        await store.put(cp.token, cp);
+        for (let i = 0; i < MAX_PENDING_STEER_ENTRIES; i++) {
+            assert.equal(await store.setPendingSteer(cp.token, cp.scope, { text: `s${i}`, trusted: false }), true);
+        }
+        await assert.rejects(store.setPendingSteer(cp.token, cp.scope, { text: "overflow", trusted: false }), (e) => e.code === "steering.queue_full");
+        const q = readPendingSteerQueue((await store.get(cp.token)).state);
+        assert.equal(q.length, MAX_PENDING_STEER_ENTRIES);
+        assert.deepEqual(q.map((e) => e.text), Array.from({ length: MAX_PENDING_STEER_ENTRIES }, (_, i) => `s${i}`));
+    });
+    run("a queue entry round-trips every FROZEN field (actor/inputId/priority included)", async () => {
+        const store = make();
+        const cp = createCheckpointFixture();
+        await store.put(cp.token, cp);
+        assert.equal(await store.setPendingSteer(cp.token, cp.scope, {
+            text: "attributed",
+            trusted: true,
+            actor: { id: "slack:U1", hostAsserted: true, issuer: "slack-app:A1" },
+            inputId: "m-42",
+            priority: "now",
+        }), true);
+        const q = readPendingSteerQueue((await store.get(cp.token)).state);
+        assert.deepEqual(q, [
+            { text: "attributed", trusted: true, actor: { id: "slack:U1", hostAsserted: true, issuer: "slack-app:A1" }, inputId: "m-42", priority: "now", seq: 1 },
+        ]);
+    });
+    run("an unknown steering field is REFUSED (a producer must not have its new field silently dropped)", async () => {
+        const store = make();
+        const cp = createCheckpointFixture();
+        await store.put(cp.token, cp);
+        await assert.rejects(store.setPendingSteer(cp.token, cp.scope, { text: "go", trusted: false, futureField: 1 }), (e) => e.code === "steering.invalid_content");
+        assert.deepEqual(readPendingSteerQueue((await store.get(cp.token)).state), []);
     });
     run("expire vs resolve on the same row → exactly one wins; reap expires past-deadline pending in scope", async () => {
         const store = make();

package/dist/core/task-notification.d.ts

@@ -41,6 +41,8 @@ export interface SystemInjection<TPayload = unknown> {
 }
 export declare function taskNotificationDedupKey(n: Pick<TaskNotificationPayload, "task_id" | "task_type" | "status" | "seq">): string;
 export declare function taskNotificationLaneKey(n: Pick<TaskNotificationPayload, "task_id" | "task_type">): string;
+export declare function attrEscape(value: string): string;
+export declare const EXTERNAL_SOURCE_MAX = 120;
 export declare function renderTaskNotificationXml(n: TaskNotificationPayload): string;
 export declare const MAX_PENDING_EVENTS_PER_TASK = 50;
 export declare const MAX_PENDING_EVENTS_PER_SESSION = 200;