@sema-agent/core 5.13.0 → 5.14.0

package/dist/engine/session/import-validate.js

@@ -17,6 +17,10 @@ export class StreamingImportValidator {
     rootCount = 0;
     runningLeaf = null;
     done = false;
+    preserveActorAssertions;
+    constructor(options) {
+        this.preserveActorAssertions = options?.preserveActorAssertions === true;
+    }
     step(entry) {
         if (this.done) {
             throw new SessionError("invalid_session", "StreamingImportValidator.step() called after finish()");
@@ -55,7 +59,7 @@ export class StreamingImportValidator {
         }
         if (e.type === "message") {
             validateMessageContentShape(e.message, `Entry "${e.id}"`);
-            normalizeEngineProvenanceStamp(e.message);
+            normalizeEngineProvenanceStamp(e.message, this.preserveActorAssertions);
         }
         else if (e.type === "custom_message") {
             validateContentShape(e.content, CUSTOM_CONTENT_BLOCK_TYPES, true, `Entry "${e.id}".content`);
@@ -208,12 +212,15 @@ export class StreamingImportValidator {
         return { leafId: this.runningLeaf };
     }
 }
-export function validateEntriesForImport(entries) {
-    const v = new StreamingImportValidator();
-    for (const e of entries)
+export function validateEntriesForImport(entries, options) {
+    const protectedEntries = entries.map((e) => e.type === "message" && typeof e.message === "object" && e.message !== null && !Array.isArray(e.message)
+        ? { ...e, message: { ...e.message } }
+        : e);
+    const v = new StreamingImportValidator(options);
+    for (const e of protectedEntries)
         v.step(e);
     v.finish();
-    return entries;
+    return protectedEntries;
 }
 const TEXT_IMAGE_BLOCK_TYPES = new Set(["text", "image"]);
 const CUSTOM_CONTENT_BLOCK_TYPES = TEXT_IMAGE_BLOCK_TYPES;
@@ -235,12 +242,28 @@ function describeShape(value) {
     }
     return `a ${typeof value}`;
 }
-function normalizeEngineProvenanceStamp(message) {
+function normalizeEngineProvenanceStamp(message, preserveActorAssertions = false) {
     if (message === null || typeof message !== "object")
         return;
     const m = message;
     if (m.role !== "user")
         return;
+    if (m.actor !== undefined) {
+        const a = m.actor;
+        const wellFormed = preserveActorAssertions &&
+            a !== null &&
+            typeof a === "object" &&
+            typeof a.id === "string" &&
+            a.id.length > 0 &&
+            typeof a.hostAsserted === "boolean" &&
+            (a.issuer === undefined || (typeof a.issuer === "string" && a.issuer.length > 0));
+        if (wellFormed) {
+            m.actor = { id: a.id, hostAsserted: a.hostAsserted, ...(a.issuer !== undefined ? { issuer: a.issuer } : {}) };
+        }
+        else {
+            delete m.actor;
+        }
+    }
     if (m.engineMinted !== undefined && m.engineMinted !== true)
         delete m.engineMinted;
     if (m.provenance !== undefined && m.provenance !== "engine-note")

package/dist/engine/session/memory-repo.d.ts

@@ -11,5 +11,7 @@ export declare class InMemorySessionRepo implements SessionRepo<SessionMetadata,
     delete(metadata: SessionMetadata): Promise<void>;
     fork(sourceMetadata: SessionMetadata, options: SessionForkOptions): Promise<Session>;
     exportEntries(sessionId: string): Promise<SessionTreeEntry[]>;
-    importEntries(sessionId: string, owner: string | undefined, entries: SessionTreeEntry[]): Promise<void>;
+    importEntries(sessionId: string, owner: string | undefined, entries: SessionTreeEntry[], options?: {
+        preserveActorAssertions?: boolean;
+    }): Promise<void>;
 }

package/dist/engine/session/memory-repo.js

@@ -49,9 +49,9 @@ export class InMemorySessionRepo {
         const session = await this.open({ id: sessionId, createdAt: "" });
         return session.getStorage().getEntries();
     }
-    async importEntries(sessionId, owner, entries) {
+    async importEntries(sessionId, owner, entries, options) {
         void owner;
-        const validated = validateEntriesForImport(entries);
+        const validated = validateEntriesForImport(entries, options);
         const metadata = { id: sessionId, createdAt: createTimestamp() };
         this.sessions.set(sessionId, toSession(new InMemorySessionStorage({ metadata, entries: validated })));
     }

package/dist/index.d.ts

@@ -15,7 +15,7 @@ export { createTaskListTools, createMemoryTaskListStore, assertJsonMetadata, typ
 export { assembleCodeTools, type CodeToolsConfig, CODE_ROLE } from "./scenarios/full-body.js";
 export { capAggregateToolResults, AGGREGATE_TOOL_RESULT_BUDGET_CHARS, DEFAULT_BUDGET_EXEMPT_TOOLS, type AggregateBudgetOptions, } from "./core/tool-result-budget.js";
 export { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES, type MediaStripInfo } from "./core/media-byte-cap.js";
-export { createAskUserQuestionTool, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, type OnQuestion, type AskQuestion, type AskQuestionOption, type AskQuestionRequest, type QuestionAnswer, type QuestionAnswerItem, } from "./core/ask-question.js";
+export { createAskUserQuestionTool, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, isQuestionUnavailable, type OnQuestionOutcome, type QuestionUnavailable, type OnQuestion, type AskQuestion, type AskQuestionOption, type AskQuestionRequest, type QuestionAnswer, type QuestionAnswerItem, type AskQuestionCardDetails, type AskUserQuestionToolOptions, type AskAnswerContinuationSource, type SyntheticContinuationReason, } from "./core/ask-question.js";
 export { createLspTool, gitCheckIgnoreFilter, LSP_OPERATIONS, LSP_FAILURE_BRAND, brandLspFailure, lspFailureOf, SharedAbortScope, settleOnAbort, type LspNoneReason, type LspOperation, type LspServerManager, type LspSession, type LspResult, type LspLocation, type LspSymbolInfo, type LspRequestParams, type LspToolOptions, type LspTransport, type LspReadText, } from "./core/lsp.js";
 export { buildRequest, parseResult, callHierarchyMethod, pathToUri } from "./core/lsp-protocol.js";
 export { TransportLspSession, type SessionWarmup } from "./core/lsp-session.js";
@@ -82,7 +82,7 @@ export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW,
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, type BashReadonlyRootBoundary, type CompoundReadonlyVerdict, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, type ToolResultStore, type ToolResultSlice, } from "./core/tool-result-store.js";
-export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
+export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, type UsageWindow, type UsageWindowStore, type UsageWindowReading, type UsageWindowRecord, type UsageSlot, type UsageBucketRow, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
 export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./core/runner/prepare-task.js";
@@ -97,7 +97,10 @@ export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./cor
 export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, taskNotificationDedupKey, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, } from "./core/task-notification.js";
+export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, type WiringManifest, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
+export { type StoreDurability } from "./core/checkpoint-store.js";
+export { projectHumanInput, buildHumanInputEvent, type HumanInputSource, type HumanInputFrame, type HumanInputEvent, type HumanInputDelivery, } from "./core/human-input-projection.js";
 export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, type SemaTaskType, type SemaTaskStatus, type SemaTaskHandle, type ParkedClaimTicket, type TaskAccess, type UnifiedTaskOutput, type TaskRetrievalStatus, type StopSource, type RegisterMonitorInput, type MonitorTimers, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, } from "./core/task-registry.js";
 export { InMemoryMailboxStore, type MailboxStore, type MailboxMessage, type MailboxLease } from "./core/mailbox-store.js";
 export { FileMailboxStore, type FileMailboxStoreOptions } from "./stores/file/mailbox-store.js";
@@ -123,7 +126,7 @@ export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, typ
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, type PermissionRule, type ParsedPermissionRule, type PermissionRuleIssue, type PermissionRuleCaps, type PermissionRulePolicyOptions, } from "./core/permission-rules.js";
-export { formatHookFeedback, runToolGate, type Hooks, type HookToolContext, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
+export { formatHookFeedback, runToolGate, createHookEnvCapabilities, type Hooks, type HookToolContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";

package/dist/index.js

@@ -12,7 +12,7 @@ export { createTaskListTools, createMemoryTaskListStore, assertJsonMetadata } fr
 export { assembleCodeTools, CODE_ROLE } from "./scenarios/full-body.js";
 export { capAggregateToolResults, AGGREGATE_TOOL_RESULT_BUDGET_CHARS, DEFAULT_BUDGET_EXEMPT_TOOLS, } from "./core/tool-result-budget.js";
 export { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES } from "./core/media-byte-cap.js";
-export { createAskUserQuestionTool, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, } from "./core/ask-question.js";
+export { createAskUserQuestionTool, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, isQuestionUnavailable, } from "./core/ask-question.js";
 export { createLspTool, gitCheckIgnoreFilter, LSP_OPERATIONS, LSP_FAILURE_BRAND, brandLspFailure, lspFailureOf, SharedAbortScope, settleOnAbort, } from "./core/lsp.js";
 export { buildRequest, parseResult, callHierarchyMethod, pathToUri } from "./core/lsp-protocol.js";
 export { TransportLspSession } from "./core/lsp-session.js";
@@ -70,7 +70,7 @@ export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW,
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, } from "./core/tool-result-store.js";
-export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, } from "./core/checkpoint-store.js";
+export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
 export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./core/runner/prepare-task.js";
@@ -84,7 +84,10 @@ export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./cor
 export { createFsWriteGatePolicy } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, taskNotificationDedupKey, SystemInjectionQueue, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, SystemInjectionQueue, } from "./core/task-notification.js";
+export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, } from "./core/wiring-manifest.js";
+export {} from "./core/checkpoint-store.js";
+export { projectHumanInput, buildHumanInputEvent, } from "./core/human-input-projection.js";
 export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, } from "./core/task-registry.js";
 export { InMemoryMailboxStore } from "./core/mailbox-store.js";
 export { FileMailboxStore } from "./stores/file/mailbox-store.js";
@@ -108,7 +111,7 @@ export { parseAutoModeResponse, createAutoModeDecider, } from "./core/auto-mode.
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, } from "./core/permission-rules.js";
-export { formatHookFeedback, runToolGate, } from "./core/hooks.js";
+export { formatHookFeedback, runToolGate, createHookEnvCapabilities, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";

package/dist/internal/harness-types.d.ts

@@ -2,7 +2,7 @@ export type { CompactionPreparation, SummarizationClampDryRun } from "../engine/
 export type { InvokedSkillRetention } from "../engine/compaction/utils.js";
 export type { AgentCoreRuntimeDeps } from "../engine/loop/runtime-deps.js";
 export type { AgentMessage, AgentTool, AgentToolResult, AgentToolUpdateCallback, ThinkingLevel, ToolExecutionMode, } from "../engine/loop/types.js";
-export type { AgentHarnessEvent, CompactionSettings, ExecutionEnv, ExecutionErrorCode, FileErrorCode, FileInfo, Result, Session, SessionMetadata, SessionRepo, SessionStorage, SessionTreeEntry, Skill, } from "../engine/harness/types.js";
+export type { AgentHarnessEvent, CompactionSettings, ExecutionEnv, ExecutionErrorCode, FileError, FileErrorCode, FileInfo, Result, Session, SessionMetadata, SessionRepo, SessionStorage, SessionTreeEntry, Skill, } from "../engine/harness/types.js";
 export type { ExecutionEnvExecOptions, ExecResult } from "../engine/harness/types.js";
 export type { SessionWriteOptions, CompactionEntry } from "../engine/harness/types.js";
 export type { ActiveWorktreeSession, WorkspaceState } from "../engine/harness/types.js";

package/dist/internal/llm.d.ts

@@ -1,2 +1,2 @@
-export { createAssistantMessageEventStream, stripEngineMetadata } from "../engine/llm/index.js";
-export type { AnthropicMessagesCompat, OpenAICompletionsCompat, OpenAIResponsesCompat, AssistantMessage, AssistantMessageDiagnostic, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, Model, ResilienceOptions, SimpleStreamOptions, StallTimeouts, StopReason, StreamFn, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage, Usage, UserMessage, } from "../engine/llm/index.js";
+export { createAssistantMessageEventStream, snapshotActorAssertion, stripEngineMetadata } from "../engine/llm/index.js";
+export type { ActorAssertion, AnthropicMessagesCompat, OpenAICompletionsCompat, OpenAIResponsesCompat, AssistantMessage, AssistantMessageDiagnostic, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, Model, ResilienceOptions, SimpleStreamOptions, StallTimeouts, StopReason, StreamFn, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage, Usage, UserMessage, } from "../engine/llm/index.js";

package/dist/internal/llm.js

@@ -1 +1 @@
-export { createAssistantMessageEventStream, stripEngineMetadata } from "../engine/llm/index.js";
+export { createAssistantMessageEventStream, snapshotActorAssertion, stripEngineMetadata } from "../engine/llm/index.js";

package/dist/orchestration/run-workflow-tool.d.ts

@@ -81,6 +81,7 @@ export interface RunWorkflowToolDeps {
     sourceTaskId?: string;
     principal?: string;
     oneShot?: boolean;
+    parentInteractionPosture?: "interactive" | "headless";
     workflowDepth?: number;
     parentCwd?: string;
     parentThinking?: () => import("../core/types.js").TaskSpec["thinking"];
@@ -88,5 +89,8 @@ export interface RunWorkflowToolDeps {
     parentGetApiKeyAndHeaders?: import("../core/types.js").TaskSpec["getApiKeyAndHeaders"];
     forwardEvent?: (event: import("../core/types.js").TaskEvent) => void;
     inheritedGateForChildren?: () => import("../core/runner/prepare-task.js").InheritedGate;
+    autoModeReview?: () => {
+        decider: import("../core/auto-mode.js").AutoModeDecider;
+    } | undefined;
 }
 export declare function createRunWorkflowTool(d: RunWorkflowToolDeps): Promise<AgentTool>;

package/dist/orchestration/run-workflow-tool.js

@@ -388,6 +388,7 @@ export async function createRunWorkflowTool(d) {
             }
             let handle;
             const workflowTaskId = d.taskRegistry?.mintTaskId("workflow");
+            const autoModeReview = ctx.autoModeReview ?? d.autoModeReview?.();
             try {
                 handle = startWorkflow(d.runner, scriptFn, {
                     store: d.store,
@@ -413,6 +414,7 @@ export async function createRunWorkflowTool(d) {
                     ...(d.parentCwd !== undefined ? { parentCwd: d.parentCwd } : {}),
                     parentToolCallId: ctx.toolCallId,
                     ...(sourceTaskId !== undefined ? { parentTaskId: sourceTaskId } : {}),
+                    ...((ctx.interactionPosture ?? d.parentInteractionPosture) !== undefined ? { interactionPosture: (ctx.interactionPosture ?? d.parentInteractionPosture) } : {}),
                     ...(d.parentModel !== undefined ? { defaultModel: d.parentModel } : {}),
                     ...(d.parentGetApiKeyAndHeaders !== undefined ? { defaultGetApiKeyAndHeaders: d.parentGetApiKeyAndHeaders } : {}),
                     ...(ctx.centerArtifactDigest !== undefined ? { parentCenterArtifactDigest: ctx.centerArtifactDigest } : {}),
@@ -421,6 +423,7 @@ export async function createRunWorkflowTool(d) {
                     ...((ctx.inheritedGateForChildren ?? d.inheritedGateForChildren) !== undefined
                         ? { inheritedGate: (ctx.inheritedGateForChildren ?? d.inheritedGateForChildren)() }
                         : {}),
+                    ...(autoModeReview !== undefined ? { autoModeReview } : {}),
                 }, { workflowDepth: d.workflowDepth });
             }
             catch (err) {

package/dist/orchestration/workflow-types.d.ts

@@ -187,6 +187,14 @@ export declare class WorkflowAgentStalledError extends Error {
     readonly code = "workflow.agent_stalled";
     constructor(attempts: number, stallMs: number, lastResult?: TaskResult | undefined);
 }
+export declare const WORKFLOW_SPAWN_BLOCKED_ERROR_CODE = "autoMode.spawn_blocked";
+export declare class WorkflowAgentBlockedError extends Error {
+    readonly label: string;
+    readonly category: string;
+    readonly reason: string;
+    readonly code = "workflow.agent_blocked";
+    constructor(label: string, category: string, reason: string);
+}
 export declare class WorkflowMaxAgentsError extends Error {
     readonly max: number;
     readonly code = "workflow.max_agents";

package/dist/orchestration/workflow-types.js

@@ -41,6 +41,20 @@ export class WorkflowAgentStalledError extends Error {
         this.name = "WorkflowAgentStalledError";
     }
 }
+export const WORKFLOW_SPAWN_BLOCKED_ERROR_CODE = "autoMode.spawn_blocked";
+export class WorkflowAgentBlockedError extends Error {
+    label;
+    category;
+    reason;
+    code = "workflow.agent_blocked";
+    constructor(label, category, reason) {
+        super(`workflow agent "${label}" was not started: blocked by the pre-spawn review${reason ? `: ${reason}` : ""}`);
+        this.label = label;
+        this.category = category;
+        this.reason = reason;
+        this.name = "WorkflowAgentBlockedError";
+    }
+}
 export class WorkflowMaxAgentsError extends Error {
     max;
     code = "workflow.max_agents";

package/dist/orchestration/workflow.d.ts

@@ -96,12 +96,16 @@ export interface RunWorkflowOptions {
     parentCwd?: string;
     parentToolCallId?: string;
     parentTaskId?: string;
+    interactionPosture?: "interactive" | "headless";
     defaultModel?: () => import("../internal/llm.js").Model | undefined;
     defaultGetApiKeyAndHeaders?: TaskSpec["getApiKeyAndHeaders"];
     parentCenterArtifactDigest?: string;
     parentCenterSourceRevision?: string;
     onForwardEvent?: (event: TaskEvent) => void;
     inheritedGate?: import("../core/runner/prepare-task.js").InheritedGate;
+    autoModeReview?: {
+        decider: import("../core/auto-mode.js").AutoModeDecider;
+    };
     phases?: ReadonlyArray<{
         title: string;
         detail?: string;

package/dist/orchestration/workflow.js

@@ -16,12 +16,43 @@ import { boundedRedactedSummary } from "../core/untrusted-egress.js";
 import { delimitUntrusted } from "../core/untrusted-text.js";
 import { OUTPUT_TOOL_NAME } from "../core/runner/synthetic-tools.js";
 import { compileOutputSchema } from "../core/runner/strict-output-schema.js";
-import { WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowMaxAgentsError } from "./workflow-types.js";
+import { WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentBlockedError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowMaxAgentsError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE } from "./workflow-types.js";
 export * from "./workflow-types.js";
 const MAX_TRANSCRIPT_CHARS = 4000;
 const WORKFLOW_RESULT_MAX = 4000;
 const WORKFLOW_RESULT_FULL_MAX = 200_000;
 const MAX_ACTIVITY = 30;
+const MAX_REVIEWED_SCHEMA_BYTES = 4096;
+const MAX_REVIEW_REASON_CHARS = 500;
+const MAX_REVIEWED_PROMPT_CHARS = 2_000;
+const MAX_SCHEMA_WALK_DEPTH = 32;
+function isUsableSchema(v) {
+    if (v === true)
+        return true;
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isSingleFaced(v, depth = 0) {
+    if (typeof v !== "object" || v === null)
+        return true;
+    if (depth > MAX_SCHEMA_WALK_DEPTH)
+        return false;
+    if (typeof v.toJSON === "function")
+        return false;
+    for (const key of Object.keys(v)) {
+        if (typeof Object.getOwnPropertyDescriptor(v, key)?.get === "function")
+            return false;
+    }
+    for (const child of Object.values(v)) {
+        if (!isSingleFaced(child, depth + 1))
+            return false;
+    }
+    return true;
+}
+function forReview(text) {
+    if (text.length <= MAX_REVIEWED_PROMPT_CHARS)
+        return text;
+    return `${text.slice(0, MAX_REVIEWED_PROMPT_CHARS)}\n[…TRUNCATED FOR REVIEW: ${text.length - MAX_REVIEWED_PROMPT_CHARS} further characters follow that the child WILL receive and this review did NOT see]`;
+}
 function workflowModelLabel(spec) {
     const model = spec.model;
     if (model === undefined)
@@ -473,6 +504,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
     const sem = createSemaphore(concurrency);
     const spawnAttribution = {
         isDelegatedChild: true,
+        ...(opts.interactionPosture !== undefined ? { parentInteractionPosture: opts.interactionPosture } : {}),
         ...(opts.parentToolCallId !== undefined ? { parentToolCallId: opts.parentToolCallId } : {}),
         ...(opts.parentTaskId !== undefined ? { parentTaskId: opts.parentTaskId } : {}),
         ...(opts.parentCenterArtifactDigest !== undefined ? { parentCenterArtifactDigest: opts.parentCenterArtifactDigest } : {}),
@@ -782,6 +814,83 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
         const model = workflowModelLabel(specForIdentity);
         return { label, phase, phaseInstance, groupId, inheritedModelSnap, callKey, prompt, model };
     };
+    const reviewSpawnBeforeLaunch = async (lane, label, callKey, runSpec, effectiveSignal) => {
+        const review = opts.autoModeReview;
+        if (review === undefined)
+            return runSpec;
+        const schema = runSpec.outputSchema;
+        let schemaText;
+        let specToLaunch = runSpec;
+        if (schema !== undefined) {
+            try {
+                schemaText = JSON.stringify(schema);
+            }
+            catch {
+                schemaText = undefined;
+            }
+            if (schemaText === undefined) {
+                throw new WorkflowAgentBlockedError(label, "", "the child's output schema could not be serialized for review");
+            }
+            const schemaBytes = Buffer.byteLength(schemaText, "utf8");
+            if (schemaBytes > MAX_REVIEWED_SCHEMA_BYTES) {
+                throw new WorkflowAgentBlockedError(label, "", `output schema too large to classify safely (${schemaBytes} bytes, cap ${MAX_REVIEWED_SCHEMA_BYTES})`);
+            }
+            if (!isSingleFaced(schema)) {
+                throw new WorkflowAgentBlockedError(label, "", "the child's output schema cannot be read as one unambiguous value (it overrides its own serialization, or nests deeper than the review can walk)");
+            }
+            const normalized = JSON.parse(schemaText);
+            if (!isUsableSchema(normalized)) {
+                throw new WorkflowAgentBlockedError(label, "", "the child's output schema does not normalize to a JSON Schema object");
+            }
+            specToLaunch = { ...runSpec, outputSchema: normalized };
+        }
+        const toolNames = (runSpec.tools ?? []).map((t) => t.name);
+        const toolsNote = `${toolNames.length > 0 ? toolNames.join(", ") : "(none explicitly listed)"}` +
+            ` — this is the EXPLICIT roster only. If this deployment gave the child a real execution environment,` +
+            ` its own prepare additionally mounts the standard file/shell toolkit (Read/Edit/Write/Bash/Grep/Glob)` +
+            ` on top of this list. Treat the absence of a tool here as unknown, not as denied.`;
+        const remoteSources = [
+            ...(runSpec.mcp ?? []).map((m) => `mcp:${m.name}`),
+            ...(runSpec.a2a ?? []).map((p) => `a2a:${p.name}`),
+        ];
+        const shownSources = remoteSources.slice(0, 20).map((s) => s.slice(0, 80));
+        const remoteNote = remoteSources.length > 0
+            ? `\nThis child also mounts tools from ${remoteSources.length} external capability source(s) — ${shownSources.join(", ")}${remoteSources.length > shownSources.length ? `, +${remoteSources.length - shownSources.length} more` : ""}. Each mounts its own tools under a "<source>__*" namespace; those tool names are not resolved yet and are NOT in the roster above. Treat this child as able to reach outside this process.`
+            : "";
+        const objective = forReview(runSpec.objective ?? "");
+        const systemPrompt = runSpec.systemPrompt !== undefined ? forReview(runSpec.systemPrompt) : undefined;
+        const imageCount = runSpec.images?.length ?? 0;
+        const imagesNote = imageCount > 0
+            ? `\n${imageCount} image attachment(s) ride with this child. Their CONTENT was NOT inspected by this review — the classifier leg is text-only. Treat any instruction that defers to attached or embedded content as unreviewed.`
+            : "";
+        const labelForReview = label.slice(0, 80);
+        const verdict = await review.decider
+            .decide({
+            req: {
+                toolName: "Workflow(agent)",
+                args: {
+                    objective,
+                    tools: toolNames,
+                    ...(systemPrompt !== undefined ? { systemPrompt } : {}),
+                    ...(schemaText !== undefined ? { outputSchema: schemaText } : {}),
+                    ...(imageCount > 0 ? { uninspectedImageAttachments: imageCount } : {}),
+                    ...(remoteSources.length > 0 ? { externalCapabilitySources: shownSources } : {}),
+                },
+                toolCallId: `${runId}:${callKey}`,
+            },
+            askMessage: `Reviewing a workflow-spawned sub-agent ("${labelForReview}", ${lane}) about to be started. ` +
+                `Objective: ${objective}\nTools available to it: ${toolsNote}${remoteNote}${imagesNote}`,
+        }, effectiveSignal)
+            .catch(() => ({ kind: "unavailable", cause: "error" }));
+        if (effectiveSignal?.aborted)
+            throw new Error("workflow aborted");
+        if (finalized)
+            throw new Error(`workflow run already finalized — ${lane} cannot spawn after the run ended`);
+        if (verdict.kind === "block") {
+            throw new WorkflowAgentBlockedError(label, verdict.category, boundedRedactedSummary(verdict.reason, MAX_REVIEW_REASON_CHARS));
+        }
+        return specToLaunch;
+    };
     const createUsageBeat = (rec) => {
         let beatTokens = 0;
         let beatTurns = 0;
@@ -931,15 +1040,16 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 const typedSpec = typedSpec0.model === undefined && inheritedModelSnap !== undefined ? { ...typedSpec0, model: inheritedModelSnap } : typedSpec0;
                 const framedSpec = withWorkflowChildPersona(typedSpec, agentOpts.schema ?? typedSpec.outputSchema);
                 const authInherit = framedSpec.getApiKeyAndHeaders === undefined && opts.defaultGetApiKeyAndHeaders !== undefined ? { getApiKeyAndHeaders: opts.defaultGetApiKeyAndHeaders } : {};
-                const runSpec = agentOpts.schema
+                const preReviewSpec = agentOpts.schema
                     ? { ...framedSpec, ...authInherit, signal: effectiveSignal, outputSchema: agentOpts.schema }
                     : { ...framedSpec, ...authInherit, signal: effectiveSignal };
+                const runSpec = await reviewSpawnBeforeLaunch("ctx.agent", label, callKey, preReviewSpec, effectiveSignal);
                 const enrichedForward = opts.onForwardEvent !== undefined
                     ? (e) => {
                         opts.onForwardEvent(e.type === "task_progress" ? { ...e, workflowRunId: runId, workflowAgentLabel: label } : e);
                     }
                     : undefined;
-                const baseInternals = { ...(agentOpts.isolation ? { isolation: agentOpts.isolation } : {}), ...(opts.parentCwd !== undefined ? { parentCwd: opts.parentCwd } : {}), ...spawnAttribution, ...(enrichedForward !== undefined ? { onForwardEvent: enrichedForward } : {}), agentName: label, onWorkspaceResolved: createWorkspaceObserver(rec) };
+                const baseInternals = { ...(agentOpts.isolation ? { isolation: agentOpts.isolation } : {}), ...(opts.parentCwd !== undefined ? { parentCwd: opts.parentCwd } : {}), ...spawnAttribution, ...(enrichedForward !== undefined ? { onForwardEvent: enrichedForward } : {}), delegationTaskType: "workflow", agentName: label, onWorkspaceResolved: createWorkspaceObserver(rec) };
                 let attempts = 0;
                 let throttleRetried = false;
                 let lastAttemptReason;
@@ -1128,6 +1238,10 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                         rec.output = boundedRedactedSummary(salvaged.structuredOutput ?? salvaged.result, MAX_TRANSCRIPT_CHARS) || (rec.errorMessage ?? "");
                         rec.stats = { tokens: salvaged.stats.tokens ?? 0, turns: salvaged.stats.turns ?? 0, costMicroUsd: salvaged.stats.costMicroUsd };
                     }
+                    if (err instanceof WorkflowAgentBlockedError) {
+                        rec.errorCode = WORKFLOW_SPAWN_BLOCKED_ERROR_CODE;
+                        rec.errorMessage = boundedRedactedSummary(err.message, MAX_TRANSCRIPT_CHARS);
+                    }
                     if (err instanceof WorkflowAgentStalledError && err.attempts > 1) {
                         rec.attempts = err.attempts;
                         rec.lastAttemptReason = "stalled";
@@ -1139,6 +1253,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                         sessionId: "",
                         status: "failed",
                         result: boundedRedactedSummary(err instanceof Error ? err.message : String(err), 500),
+                        ...(err instanceof WorkflowAgentBlockedError ? { errorCode: WORKFLOW_SPAWN_BLOCKED_ERROR_CODE } : {}),
                         stats: { turns: 0, tokens: 0, costMicroUsd: 0 },
                     }, label).catch(() => undefined);
                     bceTerminal(callKey, "failed", rec.output ?? (err instanceof Error ? err.message : String(err)), rec.sessionId, rec.stats);
@@ -1184,7 +1299,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 if (!finalized) {
                     rec.status = "failed";
                     rec.endedAt = now();
-                    emit({ type: "agent_end", runId, label, phase, ...(groupId !== undefined ? { groupId } : {}), status: "failed", ts: rec.endedAt });
+                    emit({ type: "agent_end", runId, label, phase, ...(groupId !== undefined ? { groupId } : {}), status: "failed", ...(rec.errorCode !== undefined ? { errorCode: rec.errorCode } : {}), ts: rec.endedAt });
                     void persist("update");
                 }
             };
@@ -1205,7 +1320,8 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 const baseRunSpec = agentOpts.schema
                     ? { ...framedSpec, ...authInherit, signal: effectiveSignal, outputSchema: agentOpts.schema }
                     : { ...framedSpec, ...authInherit, signal: effectiveSignal };
-                const runSpec = childSessionId !== undefined ? { ...baseRunSpec, sessionId: childSessionId } : baseRunSpec;
+                const preReviewSpec = childSessionId !== undefined ? { ...baseRunSpec, sessionId: childSessionId } : baseRunSpec;
+                const runSpec = await reviewSpawnBeforeLaunch("ctx.agentStream", label, callKey, preReviewSpec, effectiveSignal);
                 const enrichedForwardS = opts.onForwardEvent !== undefined
                     ? (e) => {
                         opts.onForwardEvent(e.type === "task_progress" ? { ...e, workflowRunId: runId, workflowAgentLabel: label } : e);
@@ -1216,6 +1332,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                     ...(opts.parentCwd !== undefined ? { parentCwd: opts.parentCwd } : {}),
                     ...spawnAttribution,
                     ...(enrichedForwardS !== undefined ? { onForwardEvent: enrichedForwardS } : {}),
+                    delegationTaskType: "workflow",
                     agentName: label,
                     onActivity,
                     onWorkspaceResolved: createWorkspaceObserver(rec),
@@ -1236,6 +1353,18 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 stream = workflowDepthStore.run({ depth: depth + 1 }, () => runner.runTaskStream(runSpec, undefined, runInternals));
             }
             catch (err) {
+                if (!finalized && err instanceof WorkflowAgentBlockedError) {
+                    rec.errorCode = WORKFLOW_SPAWN_BLOCKED_ERROR_CODE;
+                    rec.errorMessage = boundedRedactedSummary(err.message, MAX_TRANSCRIPT_CHARS);
+                    void journalAppend(callKey, {
+                        taskId: callKey,
+                        sessionId: "",
+                        status: "failed",
+                        result: boundedRedactedSummary(err.message, 500),
+                        errorCode: WORKFLOW_SPAWN_BLOCKED_ERROR_CODE,
+                        stats: { turns: 0, tokens: 0, costMicroUsd: 0 },
+                    }).catch(() => undefined);
+                }
                 recordFailed();
                 releaseOnce();
                 bceTerminal(callKey, "failed", err instanceof Error ? err.message : String(err), undefined, undefined);

package/dist/prompts/default.js

@@ -183,7 +183,7 @@ Use this directory for ALL temporary file needs:
 
 Only use \`/tmp\` if the user explicitly requests it.
 
-The scratchpad directory is session-specific, isolated from the user's project, and can generally be used without permission prompts.`;
+The scratchpad directory is session-specific, isolated from the user's project, and can generally be used without permission prompts. Treat it as ephemeral — it may not survive a long suspension or a resume on a different worker; keep durable outputs in the working directory.`;
 }
 export const GIT_STATUS_MAX_CHARS = 2000;
 export function buildGitSnapshot(p) {

package/dist/stores/file/checkpoint-store.d.ts

@@ -1,9 +1,10 @@
-import { type Checkpoint, type CheckpointFaultMode, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type ReopenReason, type ResolveExpectation, type ResumeOutcome } from "../../core/checkpoint-store.js";
+import { type Checkpoint, type PendingSteerInput, type CheckpointFaultMode, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type ReopenReason, type ResolveExpectation, type ResumeOutcome } from "../../core/checkpoint-store.js";
 export interface FileCheckpointStoreOptions {
     fsync?: boolean;
     compactEvery?: number;
 }
 export declare class FileCheckpointStore implements CheckpointStore {
+    readonly durability: "durable";
     private readonly fsyncEnabled;
     private readonly compactEvery;
     private readonly ledger;
@@ -17,10 +18,7 @@ export declare class FileCheckpointStore implements CheckpointStore {
     get(token: CheckpointToken): Promise<Checkpoint | null>;
     resolve(token: CheckpointToken, scope: string, outcome: ResumeOutcome, expect?: ResolveExpectation): Promise<boolean>;
     reopen(token: CheckpointToken, scope: string, reason: ReopenReason): Promise<boolean>;
-    setPendingSteer(token: CheckpointToken, scope: string, steer: {
-        text: string;
-        trusted: boolean;
-    }): Promise<boolean>;
+    setPendingSteer(token: CheckpointToken, scope: string, steer: PendingSteerInput): Promise<boolean>;
     expire(token: CheckpointToken, scope: string): Promise<boolean>;
     reap(scope: string, cutoff: number): Promise<number>;
     listByScope(scope: string): Promise<CheckpointSummary[]>;

package/dist/stores/file/checkpoint-store.js

@@ -1,7 +1,20 @@
 import { join } from "node:path";
-import { CheckpointError, checkpointOccMatches, checkpointRowMatches, summarizeCheckpoint, validatePendingSteer, winnerFromOutcome, } from "../../core/checkpoint-store.js";
+import { appendPendingSteer, CheckpointError, checkpointOccMatches, checkpointRowMatches, summarizeCheckpoint, validatePendingSteer, winnerFromOutcome, } from "../../core/checkpoint-store.js";
 import { SharedLedgerTable } from "./shared-ledger.js";
+const CHECKPOINT_LEDGER_EVENT_REGISTRY = {
+    put: true,
+    resolve: true,
+    reopen: true,
+    expire: true,
+    steer: true,
+    steer_append: true,
+};
+const KNOWN_CHECKPOINT_LEDGER_EVENTS = new Set(Object.keys(CHECKPOINT_LEDGER_EVENT_REGISTRY));
 function applyCheckpointEvent(cps, ev) {
+    if (!KNOWN_CHECKPOINT_LEDGER_EVENTS.has(ev.t)) {
+        throw new CheckpointError("checkpoint.unsupported_version", `file checkpoint ledger: unrecognised event kind "${String(ev.t)}" — ` +
+            `it was written by a newer worker; refusing the replay rather than serving an incomplete authority`);
+    }
     if (ev.t === "put") {
         cps.set(ev.token, ev.cp);
         return;
@@ -28,6 +41,17 @@ function applyCheckpointEvent(cps, ev) {
         case "steer":
             cp.state.pendingSteer = ev.steer;
             break;
+        case "steer_append": {
+            const queue = cp.state.pendingSteerQueue ?? [];
+            if (!queue.some((e) => e.inputId === ev.entry.inputId))
+                cp.state.pendingSteerQueue = [...queue, ev.entry];
+            break;
+        }
+        default: {
+            const _exhaustive = ev;
+            void _exhaustive;
+            break;
+        }
     }
 }
 const checkpointLedgers = new SharedLedgerTable({
@@ -35,6 +59,7 @@ const checkpointLedgers = new SharedLedgerTable({
     apply: applyCheckpointEvent,
 });
 export class FileCheckpointStore {
+    durability = "durable";
     fsyncEnabled;
     compactEvery;
     ledger;
@@ -114,7 +139,11 @@ export class FileCheckpointStore {
             if (!checkpointRowMatches(cp, scope, "pending")) {
                 return false;
             }
-            this.commit({ t: "steer", token, steer: clean }, this.fsyncEnabled);
+            const next = appendPendingSteer(cp.state, clean);
+            const appended = next[next.length - 1];
+            if (appended === undefined || appended.inputId !== clean.inputId)
+                return true;
+            this.commit({ t: "steer_append", token, entry: appended }, this.fsyncEnabled);
             return true;
         });
     }