@sema-agent/core 5.13.0 → 5.15.0

package/dist/core/runner/tool-disclosure.d.ts

@@ -5,6 +5,8 @@ import type { ToolSpec } from "../types.js";
 import type { ToolFingerprintInput } from "../cache-break-detector.js";
 export declare const TOOL_SEARCH_NAME = "ToolSearch";
 export declare const TOOL_SEARCH_DEFAULT_MAX_RESULTS = 5;
+export declare const DEFERRED_NO_PROGRESS_LIMIT = 3;
+export declare const DEFERRED_SCHEMA_INCOMPATIBLE_CODE = "tool.deferred_schema_incompatible";
 export interface DeferredToolInfo {
     name: string;
     hint: string;
@@ -28,12 +30,14 @@ export declare function buildDeferredRegistry(deferred: ReadonlySet<string>, too
 export interface PlaceholderDirectCall {
     resolveReal: () => PlaceholderDirectTarget | undefined;
     executionMode?: ToolExecutionMode;
+    staticFace?: () => boolean;
     activate: () => Promise<string | undefined>;
 }
 export interface PlaceholderDirectTarget {
     parameters: TSchema;
     invoke: (toolCallId: string, params: unknown, signal?: AbortSignal, onUpdate?: AgentToolUpdateCallback<unknown>) => Promise<AgentToolResult<unknown>>;
 }
+export declare function staticSchemaRenderable(schema: TSchema | undefined): boolean;
 export declare function createPlaceholderTool(info: DeferredToolInfo, direct?: PlaceholderDirectCall): AgentTool;
 export declare function scoreToolMatch(query: string, info: DeferredToolInfo): number;
 export interface ToolSearchArgs {
@@ -53,6 +57,7 @@ export declare function createToolSearchTool(opts: {
     listingRide?: (newlyActivated: readonly string[]) => string | undefined;
     mountedNames?: () => ReadonlySet<string>;
     directCallEnabled?: boolean;
+    isMounted?: (name: string) => boolean;
     serializeActivation?: <T>(section: () => Promise<T>) => Promise<T>;
     staticSchemaFor?: (name: string) => TSchema | undefined;
 }): AgentTool;

package/dist/core/runner/tool-disclosure.js

@@ -7,6 +7,8 @@ const DEFER_AUTO_FRACTION = 0.1;
 const CHARS_PER_TOKEN = 4;
 export const TOOL_SEARCH_DEFAULT_MAX_RESULTS = 5;
 const MAX_QUERY_RESULTS = 25;
+export const DEFERRED_NO_PROGRESS_LIMIT = 3;
+export const DEFERRED_SCHEMA_INCOMPATIBLE_CODE = "tool.deferred_schema_incompatible";
 const EMPTY_PARAMS = Type.Object({});
 export function deferHint(description, max = 120) {
     const first = (description.split("\n").find((l) => l.trim() !== "") ?? "").trim();
@@ -70,7 +72,13 @@ function renderSchemaForModel(schema) {
     catch {
         return undefined;
     }
-    return json === undefined ? undefined : truncateError(json);
+    if (json === undefined)
+        return undefined;
+    const text = truncateError(json);
+    return { text, complete: text === json };
+}
+export function staticSchemaRenderable(schema) {
+    return schema !== undefined && renderSchemaForModel(schema)?.complete === true;
 }
 export function createPlaceholderTool(info, direct) {
     const sn = safeName(info.name);
@@ -78,10 +86,36 @@ export function createPlaceholderTool(info, direct) {
         throw new Error(`Tool "${sn}" is not active yet. Call ${TOOL_SEARCH_NAME} with {"query":"select:${sn}"} ` +
             `(or a keyword \`query\`) to load its full schema, then call ${sn} with the proper arguments.`);
     };
-    const invalidArgumentsRejection = (target, params, schemaJson, ride) => {
-        const text = `Invalid arguments for \`${sn}\`: ${formatZodValidationError(target.parameters, params)} ` +
-            `\`${sn}\` is now active — its full parameter schema is below; use it for this and later calls. ` +
-            `Call \`${sn}\` again with arguments matching it.\nParameter schema: ${schemaJson}`;
+    let lastFailureShape;
+    let repeats = 0;
+    const invalidArgumentsRejection = (target, params, schema, ride) => {
+        const completeness = schema.complete ? "its full parameter schema" : "an ABRIDGED copy of its parameter schema (too large to inline in full)";
+        const durability = !schema.complete
+            ? `${completeness} is below; the tools list carries the complete declaration. `
+            : direct?.staticFace?.() === true
+                ? `${completeness} is below and is carried by THIS result only — the tools list keeps the compact ` +
+                    `placeholder entry, so re-run ${TOOL_SEARCH_NAME} with {"query":"select:${sn}"} if you need the schema again later. `
+                : `${completeness} is below, and the next request's tools list will advertise it too. `;
+        const shape = formatZodValidationError(target.parameters, params);
+        repeats = shape === lastFailureShape ? repeats + 1 : 1;
+        lastFailureShape = shape;
+        if (repeats >= DEFERRED_NO_PROGRESS_LIMIT) {
+            const stuck = `\`${sn}\` rejected the same arguments ${repeats} times in a row and its parameter schema has already ` +
+                `been delivered, so re-sending them will not start working. This usually means the caller cannot ` +
+                `produce arguments outside the compact placeholder entry advertised for \`${sn}\`. \`${sn}\` is ` +
+                `finished for this run — no further call to it will be answered differently. Other tools are ` +
+                `unaffected; if this was the only work left, the run stops here. ` +
+                `(${DEFERRED_SCHEMA_INCOMPATIBLE_CODE})\nLast rejection: ${shape}`;
+            return {
+                content: [{ type: "text", text: stuck }],
+                details: { invalidArguments: true, noProgress: DEFERRED_SCHEMA_INCOMPATIBLE_CODE, repeats },
+                isError: true,
+                terminate: true,
+            };
+        }
+        const text = `Invalid arguments for \`${sn}\`: ${shape} ` +
+            `\`${sn}\` is now active — ${durability}` +
+            `Call \`${sn}\` again with arguments matching it.\nParameter schema: ${schema.text}`;
         return {
             content: ride === undefined || ride === "" ? [{ type: "text", text }] : [{ type: "text", text }, { type: "text", text: ride }],
             details: { invalidArguments: true },
@@ -102,17 +136,19 @@ export function createPlaceholderTool(info, direct) {
                 if (real === undefined)
                     return teachingRejection();
                 if (Value.Check(real.parameters, params)) {
+                    lastFailureShape = undefined;
+                    repeats = 0;
                     const ride = await direct.activate();
                     const result = await real.invoke(toolCallId, params, signal, onUpdate);
                     if (ride === undefined || ride === "")
                         return result;
                     return { ...result, content: [...result.content, { type: "text", text: ride }] };
                 }
-                const schemaJson = renderSchemaForModel(real.parameters);
-                if (schemaJson === undefined)
+                const schemaRender = renderSchemaForModel(real.parameters);
+                if (schemaRender === undefined)
                     return teachingRejection();
                 const ride = await direct.activate();
-                return invalidArgumentsRejection(real, params, schemaJson, ride);
+                return invalidArgumentsRejection(real, params, schemaRender, ride);
             },
         };
     }
@@ -236,12 +272,13 @@ export function extractDiscoveredToolNames(messages, registry) {
     return [...names];
 }
 export function createToolSearchTool(opts) {
-    const { registry, active, rematerialize, listingRide, mountedNames, staticSchemaFor } = opts;
+    const { registry, active, rematerialize, listingRide, mountedNames, staticSchemaFor, isMounted } = opts;
     const directCallEnabled = opts.directCallEnabled !== false;
     const activationPosture = directCallEnabled
         ? (staticSchemaFor !== undefined
             ? "Most tools start as name-only placeholders to keep requests small; activating one here returns its full " +
-                "parameter schema in the result (the tools list keeps the compact placeholder entry). "
+                "parameter schema in the result (the tools list keeps the compact placeholder entry — except for a " +
+                "declaration too large to inline, which goes to the tools list instead). "
             : "Most tools start as name-only placeholders to keep requests small; activating one here loads its full " +
                 "parameter schema. ") +
             "Until you have that schema you cannot reliably form a call, so activate a tool rather " +
@@ -286,14 +323,21 @@ export function createToolSearchTool(opts) {
                     `selection in \`query\` instead: {"query":"select:ToolA,ToolB"}. Nothing was activated.`);
             }
             const args = (raw ?? {});
-            const { matched, missing } = resolveToolSearchDetailed(args, registry);
+            const resolved = resolveToolSearchDetailed(args, registry);
+            const missing = resolved.missing;
+            const withdrawn = isMounted === undefined ? [] : resolved.matched.filter((n) => !isMounted(n));
+            const matched = isMounted === undefined ? resolved.matched : resolved.matched.filter((n) => isMounted(n));
             const mounted = mountedNames?.() ?? new Set();
             const missCallable = missing.filter((n) => mounted.has(n));
             const missUnknown = missing.filter((n) => !mounted.has(n));
             const callableNote = missCallable.length > 0
                 ? `\nAlready available: ${missCallable.map((n) => safeName(n)).join(", ")} — ${missCallable.length > 1 ? "these tools are" : "this tool is"} not deferred; call ${missCallable.length > 1 ? "them" : "it"} directly right now (no activation needed).`
                 : "";
+            const withdrawnNote = withdrawn.length > 0
+                ? `\nNo longer available: ${withdrawn.map((n) => safeName(n)).join(", ")} — ${withdrawn.length > 1 ? "these tools were" : "this tool was"} withdrawn by ${withdrawn.length > 1 ? "their providers" : "its provider"} and cannot be activated or called.`
+                : "";
             const missingNote = callableNote +
+                withdrawnNote +
                 (missUnknown.length > 0
                     ? `\nNot found: ${missUnknown.map((n) => safeName(n)).join(", ")} — not in the deferred registry under this exact name (lookup is case-sensitive). ` +
                         "(Already-active and non-deferred tools are callable directly and don't appear here.)"
@@ -311,7 +355,7 @@ export function createToolSearchTool(opts) {
                         matches: [],
                         query: typeof args.query === "string" ? args.query : "",
                         total_deferred_tools: registry.size,
-                        ...(missing.length > 0 ? { missing: missing.map(safeName) } : {}),
+                        ...(missing.length > 0 || withdrawn.length > 0 ? { missing: [...missing, ...withdrawn].map(safeName) } : {}),
                     },
                 };
             }
@@ -332,6 +376,7 @@ export function createToolSearchTool(opts) {
                 return { newly, ride: newly.length > 0 ? listingRide?.(newly) : undefined };
             });
             const { newly, ride } = await section;
+            let missingSchemaLines = false;
             const lines = matched.map((n) => {
                 const info = registry.get(n);
                 const tag = newly.includes(n) ? "activated" : "already active";
@@ -340,12 +385,16 @@ export function createToolSearchTool(opts) {
                     return base;
                 const schema = staticSchemaFor(n);
                 const json = schema === undefined ? undefined : renderSchemaForModel(schema);
-                return json === undefined ? base : `${base}\n  parameters: ${json}`;
+                if (json === undefined || !json.complete) {
+                    missingSchemaLines = true;
+                    return `${base}\n  parameters: not inlined — this tool's full declaration is in the tools list.`;
+                }
+                return `${base}\n  parameters: ${json.text}`;
             });
             const head = staticSchemaFor !== undefined
                 ? newly.length > 0
-                    ? `Activated ${newly.length} tool(s) — call them directly with arguments matching the parameter schemas below (the tools list keeps compact placeholder entries):`
-                    : "These tools are already active — call them directly; their parameter schemas are repeated below:"
+                    ? `Activated ${newly.length} tool(s) — call them directly with arguments matching the parameter schemas below (the tools list keeps compact placeholder entries${missingSchemaLines ? ", except where a line says otherwise" : ""}):`
+                    : `These tools are already active — call them directly; their parameter schemas are repeated below${missingSchemaLines ? " where they can be inlined" : ""}:`
                 : newly.length > 0
                     ? `Activated ${newly.length} tool(s); they are now available with full parameters — call them directly:`
                     : "These tools are already active — call them directly:";
@@ -358,7 +407,7 @@ export function createToolSearchTool(opts) {
                     matches: matched.map(safeName),
                     query: typeof args.query === "string" ? args.query : "",
                     total_deferred_tools: registry.size,
-                    ...(missing.length > 0 ? { missing: missing.map(safeName) } : {}),
+                    ...(missing.length > 0 || withdrawn.length > 0 ? { missing: [...missing, ...withdrawn].map(safeName) } : {}),
                 },
             };
         },

package/dist/core/runner/tool-output-projection.js

@@ -57,6 +57,7 @@ export const toolOutputFrom = (result) => {
     return { output: raw, truncated: true, totalChars };
 };
 const CC_DETAIL_TYPES = new Set([
+    "ask-question",
     "edit", "create", "update", "bash", "notebook-edit", "notebook", "file_unchanged", "worktree", "text", "grep", "glob", "mcp",
     "agent", "task", "task-list", "task-output", "workflow-run",
     "web-fetch", "web-search", "todo", "cron-create", "cron-delete", "cron-list", "image",

package/dist/core/runner/turn-attachments.d.ts

@@ -101,6 +101,8 @@ export interface AttachmentInputs {
     backgroundTasks?: ReadonlyArray<BackgroundTaskSnapshot>;
     newTools?: readonly string[];
     newToolsStaticFace?: boolean;
+    newToolsSwappedUnderStatic?: readonly string[];
+    readdedToolsSwappedUnderStatic?: readonly string[];
     mcpToolsDelta?: McpToolsDeltaFacts;
     agentListing?: ReadonlyArray<AgentListingEntry>;
     agentToolName?: string;
@@ -150,6 +152,8 @@ export interface McpToolsDeltaFacts {
 export declare function renderToolsDelta(input: {
     added?: readonly string[];
     staticFace?: boolean;
+    swappedUnderStatic?: readonly string[];
+    readdedSwappedUnderStatic?: readonly string[];
 } & McpToolsDeltaFacts): string | undefined;
 export declare const AGENT_TOOLS_NOTE_DEFAULT = "All tools";
 export declare const AGENT_CONCURRENCY_NOTE = "When you launch multiple agents for independent work, send them in a single message with multiple tool uses so they run concurrently.";

package/dist/core/runner/turn-attachments.js

@@ -171,6 +171,12 @@ export function collectDueAttachments(state, inp) {
         const body = renderToolsDelta({
             ...(inp.newTools !== undefined ? { added: inp.newTools } : {}),
             ...(inp.newToolsStaticFace === true ? { staticFace: true } : {}),
+            ...(inp.newToolsSwappedUnderStatic !== undefined && inp.newToolsSwappedUnderStatic.length > 0
+                ? { swappedUnderStatic: inp.newToolsSwappedUnderStatic }
+                : {}),
+            ...(inp.readdedToolsSwappedUnderStatic !== undefined && inp.readdedToolsSwappedUnderStatic.length > 0
+                ? { readdedSwappedUnderStatic: inp.readdedToolsSwappedUnderStatic }
+                : {}),
             ...(inp.mcpToolsDelta ?? {}),
         });
         if (body !== undefined)
@@ -392,19 +398,26 @@ export function renderToolsDelta(input) {
     const blocks = [];
     const added = input.added ?? [];
     if (added.length > 0) {
+        const swapped = input.staticFace === true ? (input.swappedUnderStatic ?? []).filter((n) => added.includes(n)) : [];
         blocks.push((input.staticFace === true
             ? "The following deferred tools are now active — call them directly. Their parameter schemas were " +
                 "provided in the ToolSearch result (the tools list itself keeps compact placeholder entries):\n"
             : "The following deferred tools are now available. Their full schemas are loaded — call them " +
                 "directly like any other tool:\n") +
-            added.map((n) => `- ${n}`).join("\n"));
+            added.map((n) => `- ${n}`).join("\n") +
+            (swapped.length > 0
+                ? `\nException: ${swapped.join(", ")} — too large to inline, so the full declaration is in the tools list instead.`
+                : ""));
     }
     const readded = input.readded ?? [];
     if (readded.length > 0) {
         blocks.push(`${readded.length} deferred tool${readded.length === 1 ? " is" : "s are"} available again (MCP server reconnected — ` +
             `names announced earlier in this conversation): ${groupByMcpServer(readded)}. ` +
             (input.staticFace === true
-                ? `The tools list keeps compact placeholder entries — re-run ToolSearch ("select:<name>") if you need their current parameter schemas.`
+                ? `The tools list keeps compact placeholder entries — re-run ToolSearch ("select:<name>") if you need their current parameter schemas.` +
+                    ((input.readdedSwappedUnderStatic ?? []).filter((n) => readded.includes(n)).length > 0
+                        ? ` Exception: ${(input.readdedSwappedUnderStatic ?? []).filter((n) => readded.includes(n)).join(", ")} — too large to inline, so the full declaration is in the tools list instead.`
+                        : "")
                 : `Their schemas are loaded again — call them directly.`));
     }
     const removed = input.removed ?? [];

package/dist/core/session-store.d.ts

@@ -1,5 +1,6 @@
 import { type SessionRepo } from "../internal/harness.js";
 import { type AcquiredSession, type SessionStore, type SessionStoreSummary } from "./session.js";
+import type { StoreDurability } from "./checkpoint-store.js";
 import { SESSION_DEFAULT_TTL_DAYS } from "../config/defaults.js";
 export { SESSION_DEFAULT_TTL_DAYS };
 export type EvictPolicy = "delete" | "forget";
@@ -8,9 +9,11 @@ export interface TtlSessionStoreOptions {
     sweepIntervalMs?: number;
     repo?: SessionRepo;
     evict?: EvictPolicy;
+    durability?: StoreDurability;
 }
 export declare class TtlSessionStore implements SessionStore {
     readonly retention: "none";
+    readonly durability?: StoreDurability;
     private repo;
     private entries;
     private owners;

package/dist/core/session-store.js

@@ -5,6 +5,7 @@ import { SESSION_DEFAULT_TTL_DAYS } from "../config/defaults.js";
 export { SESSION_DEFAULT_TTL_DAYS };
 export class TtlSessionStore {
     retention = "none";
+    durability;
     repo;
     entries = new Map();
     owners = new Map();
@@ -15,6 +16,9 @@ export class TtlSessionStore {
     sweepTimer;
     constructor(opts = {}) {
         this.repo = opts.repo ?? new InMemorySessionRepo();
+        const durability = opts.durability ?? (opts.repo === undefined ? "process-local" : undefined);
+        if (durability !== undefined)
+            this.durability = durability;
         this.defaultTtlMs = (opts.defaultTtlDays ?? SESSION_DEFAULT_TTL_DAYS) * DAY_MS;
         this.evictPolicy = opts.evict ?? (opts.repo ? "forget" : "delete");
         if (opts.sweepIntervalMs !== undefined && opts.sweepIntervalMs > 0) {

package/dist/core/session.d.ts

@@ -20,6 +20,7 @@ export interface SessionStoreSummary {
     forkedFrom?: string;
 }
 export interface SessionStore {
+    readonly durability?: import("./checkpoint-store.js").StoreDurability;
     acquire(sessionId?: string, opts?: {
         requireExisting?: boolean;
     }): Promise<AcquiredSession>;

package/dist/core/store-contracts/background-agent-store-contract.js

@@ -52,6 +52,25 @@ export async function backgroundAgentStoreContract(mk, runAssertion) {
         assert.equal(await store.get("a1", "tenant-C"), null, "an unrelated scope must not see the row");
         assert.equal(await store.get("a-missing", S), null);
     });
+    run("the org-admission fields round-trip, and ABSENT stays absent (a backend must not invent a verdict)", async (make) => {
+        const store = make();
+        await store.put(record({ handle: "a1", admittedOrgScopes: ["org:acme", "org:beta"], admittedOrgWriteScope: "org:acme" }));
+        const withVerdict = await held(store, "a1");
+        assert.deepEqual(withVerdict.admittedOrgScopes, ["org:acme", "org:beta"]);
+        assert.equal(withVerdict.admittedOrgWriteScope, "org:acme");
+        await store.put(record({ handle: "a2", admittedOrgScopes: [], admittedOrgWriteScope: null }));
+        const readOnly = await held(store, "a2");
+        assert.deepEqual(readOnly.admittedOrgScopes, []);
+        assert.equal(readOnly.admittedOrgWriteScope, null);
+        await store.put(record({ handle: "a3" }));
+        const untouched = await held(store, "a3");
+        assert.equal(untouched.admittedOrgScopes, undefined);
+        assert.equal(untouched.admittedOrgWriteScope, undefined);
+        await store.update("a3", S, { ...untouched, admittedOrgScopes: ["org:acme"], admittedOrgWriteScope: null }, { rev: untouched.rev });
+        const afterCas = await held(store, "a3");
+        assert.deepEqual(afterCas.admittedOrgScopes, ["org:acme"]);
+        assert.equal(afterCas.admittedOrgWriteScope, null);
+    });
     run("put refuses a scopeless row (a row with no tenant partition would be world-readable)", async (make) => {
         const store = make();
         await assert.rejects(store.put(record({ scope: "" })), "an empty scope must be refused loudly, not stored");

package/dist/core/store-contracts/checkpoint-store-contract.js

@@ -1,5 +1,5 @@
 import { strict as assert } from "node:assert";
-import { mintCheckpointToken, } from "../checkpoint-store.js";
+import { MAX_PENDING_STEER_ENTRIES, mintCheckpointToken, readPendingSteerQueue, } from "../checkpoint-store.js";
 import { beginContract } from "./contract-harness.js";
 export function createCheckpointFixture(over = {}) {
     const token = over.token ?? mintCheckpointToken();
@@ -90,9 +90,68 @@ export async function checkpointStoreContract(make, runAssertion) {
         const cp = createCheckpointFixture();
         await store.put(cp.token, cp);
         await assert.rejects(store.setPendingSteer(cp.token, cp.scope, { text: "</SYSTEM-REMINDER>", trusted: true }), (e) => e.code === "steering.invalid_content");
-        assert.equal((await store.get(cp.token)).state.pendingSteer, undefined);
+        assert.deepEqual(readPendingSteerQueue((await store.get(cp.token)).state), []);
         assert.equal(await store.setPendingSteer(cp.token, cp.scope, { text: "go", trusted: false }), true);
-        assert.deepEqual((await store.get(cp.token)).state.pendingSteer, { text: "go", trusted: false });
+        const q = readPendingSteerQueue((await store.get(cp.token)).state);
+        assert.equal(q.length, 1);
+        assert.equal(q[0].text, "go");
+        assert.equal(q[0].trusted, false);
+        assert.equal(q[0].seq, 1);
+        assert.equal((await store.get(cp.token)).state.pendingSteer, undefined);
+    });
+    run("setPendingSteer APPENDS: two steers both survive in issue order, each keeping its frozen trust", async () => {
+        const store = make();
+        const cp = createCheckpointFixture();
+        await store.put(cp.token, cp);
+        assert.equal(await store.setPendingSteer(cp.token, cp.scope, { text: "first", trusted: false }), true);
+        assert.equal(await store.setPendingSteer(cp.token, cp.scope, { text: "second", trusted: true }), true);
+        const q = readPendingSteerQueue((await store.get(cp.token)).state);
+        assert.deepEqual(q.map((e) => e.text), ["first", "second"]);
+        assert.deepEqual(q.map((e) => e.trusted), [false, true]);
+        assert.deepEqual(q.map((e) => e.seq), [1, 2]);
+    });
+    run("setPendingSteer is idempotent on inputId (a retry with the caller's own message id adds nothing)", async () => {
+        const store = make();
+        const cp = createCheckpointFixture();
+        await store.put(cp.token, cp);
+        assert.equal(await store.setPendingSteer(cp.token, cp.scope, { text: "once", trusted: false, inputId: "m1" }), true);
+        assert.equal(await store.setPendingSteer(cp.token, cp.scope, { text: "once", trusted: false, inputId: "m1" }), true);
+        assert.equal(readPendingSteerQueue((await store.get(cp.token)).state).length, 1);
+    });
+    run("the queue bound is fail-loud steering.queue_full and evicts nothing", async () => {
+        const store = make();
+        const cp = createCheckpointFixture();
+        await store.put(cp.token, cp);
+        for (let i = 0; i < MAX_PENDING_STEER_ENTRIES; i++) {
+            assert.equal(await store.setPendingSteer(cp.token, cp.scope, { text: `s${i}`, trusted: false }), true);
+        }
+        await assert.rejects(store.setPendingSteer(cp.token, cp.scope, { text: "overflow", trusted: false }), (e) => e.code === "steering.queue_full");
+        const q = readPendingSteerQueue((await store.get(cp.token)).state);
+        assert.equal(q.length, MAX_PENDING_STEER_ENTRIES);
+        assert.deepEqual(q.map((e) => e.text), Array.from({ length: MAX_PENDING_STEER_ENTRIES }, (_, i) => `s${i}`));
+    });
+    run("a queue entry round-trips every FROZEN field (actor/inputId/priority included)", async () => {
+        const store = make();
+        const cp = createCheckpointFixture();
+        await store.put(cp.token, cp);
+        assert.equal(await store.setPendingSteer(cp.token, cp.scope, {
+            text: "attributed",
+            trusted: true,
+            actor: { id: "slack:U1", hostAsserted: true, issuer: "slack-app:A1" },
+            inputId: "m-42",
+            priority: "now",
+        }), true);
+        const q = readPendingSteerQueue((await store.get(cp.token)).state);
+        assert.deepEqual(q, [
+            { text: "attributed", trusted: true, actor: { id: "slack:U1", hostAsserted: true, issuer: "slack-app:A1" }, inputId: "m-42", priority: "now", seq: 1 },
+        ]);
+    });
+    run("an unknown steering field is REFUSED (a producer must not have its new field silently dropped)", async () => {
+        const store = make();
+        const cp = createCheckpointFixture();
+        await store.put(cp.token, cp);
+        await assert.rejects(store.setPendingSteer(cp.token, cp.scope, { text: "go", trusted: false, futureField: 1 }), (e) => e.code === "steering.invalid_content");
+        assert.deepEqual(readPendingSteerQueue((await store.get(cp.token)).state), []);
     });
     run("expire vs resolve on the same row → exactly one wins; reap expires past-deadline pending in scope", async () => {
         const store = make();

package/dist/core/task-notification.d.ts

@@ -41,6 +41,8 @@ export interface SystemInjection<TPayload = unknown> {
 }
 export declare function taskNotificationDedupKey(n: Pick<TaskNotificationPayload, "task_id" | "task_type" | "status" | "seq">): string;
 export declare function taskNotificationLaneKey(n: Pick<TaskNotificationPayload, "task_id" | "task_type">): string;
+export declare function attrEscape(value: string): string;
+export declare const EXTERNAL_SOURCE_MAX = 120;
 export declare function renderTaskNotificationXml(n: TaskNotificationPayload): string;
 export declare const MAX_PENDING_EVENTS_PER_TASK = 50;
 export declare const MAX_PENDING_EVENTS_PER_SESSION = 200;

package/dist/core/task-notification.js

@@ -38,10 +38,10 @@ export function taskNotificationDedupKey(n) {
 export function taskNotificationLaneKey(n) {
     return n.task_type === "external" ? `external:${n.task_id}` : n.task_id;
 }
-function attrEscape(value) {
+export function attrEscape(value) {
     return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-const EXTERNAL_SOURCE_MAX = 120;
+export const EXTERNAL_SOURCE_MAX = 120;
 export function renderTaskNotificationXml(n) {
     const usage = n.usage === undefined
         ? undefined
@@ -54,7 +54,9 @@ export function renderTaskNotificationXml(n) {
             }
         })();
     const open = n.task_type === "external"
-        ? `<task-notification type="external"${n.source !== undefined ? ` from="${attrEscape(inlineUntrusted(n.source, EXTERNAL_SOURCE_MAX))}"` : ""}>`
+        ? `<task-notification type="external"${n.source !== undefined
+            ? ` from="${attrEscape(inlineUntrusted(n.source, EXTERNAL_SOURCE_MAX))}" from-unverified="true"`
+            : ""}>`
         : "<task-notification>";
     return [
         open,

package/dist/core/task-registry-agent.d.ts

@@ -28,6 +28,7 @@ export declare function reapDurableAgentsLane(core: DurableAgentCore, scope: str
 }>;
 export declare function releaseDurableTranscriptAnchorLane(core: DurableAgentCore, id: string): void;
 export declare function bindBackgroundAgentSessionLane(core: DurableAgentCore, id: string, sessionId: string): void;
+export declare function recordBackgroundAgentOrgAdmissionLane(core: DurableAgentCore, id: string, verdict: import("./memory-admission.js").OwnOrgAdmissionVerdict): void;
 export declare function registerBackgroundAgentLane(core: DurableAgentCore, input: RegisterBackgroundAgentInput): string;
 export declare function parkBackgroundAgentLane(core: DurableAgentCore, id: string, park: {
     checkpointToken: string;

package/dist/core/task-registry-agent.js

@@ -247,6 +247,12 @@ export function bindBackgroundAgentSessionLane(core, id, sessionId) {
     handle.sessionId = sessionId;
     durableAgentWriteLane(handle, { sessionId });
 }
+export function recordBackgroundAgentOrgAdmissionLane(core, id, verdict) {
+    const handle = core.handles.get(id);
+    if (!handle || handle.type !== "background_agent")
+        return;
+    durableAgentWriteLane(handle, { admittedOrgScopes: [...verdict.scopes], admittedOrgWriteScope: verdict.writeScope });
+}
 export function registerBackgroundAgentLane(core, input) {
     assertOwnership(input, "registerBackgroundAgent");
     if (input.id !== undefined && !DURABLE_AGENT_HANDLE_RE.test(input.id)) {

package/dist/core/task-registry.d.ts

@@ -101,6 +101,7 @@ export declare class TaskRegistry {
     releaseDurableTranscriptAnchor(id: string): void;
     bindBackgroundAgentSession(id: string, sessionId: string): void;
     registerBackgroundAgent(input: RegisterBackgroundAgentInput): string;
+    recordBackgroundAgentOrgAdmission(id: string, verdict: import("./memory-admission.js").OwnOrgAdmissionVerdict): void;
     parkBackgroundAgent(id: string, park: {
         checkpointToken: string;
         seq?: number;

package/dist/core/task-registry.js

@@ -10,7 +10,7 @@ import { registerWorkflowLane, pollWorkflowLane, stopWorkflowLane } from "./task
 import { mintCompletionId, canAccessWorkflowRun, formatWorkflowRun, clipTaskOutput, assertOwnership, sleepPollStep, statusFromBackground, rollSpoolText, accountDroppedBytes, renderSpoolBody, spoolDropNote, droppedGapNote, alreadyTerminalStopNote, terminalTaskSummary, TASK_OUTPUT_MAX_CHARS, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccess, DURABLE_AGENT_HANDLE_RE, } from "./task-registry-shared.js";
 export { normalizeAgentName, DURABLE_AGENT_HEARTBEAT_MS, DURABLE_AGENT_HANDLE_RE, BG_AGENT_REAP_STOP_ERROR } from "./task-registry-shared.js";
 import { TASK_OUTPUT_TOOL_NAME, TASK_STOP_TOOL_NAME, TASK_OUTPUT_CONTRACT, TASK_STOP_CONTRACT, TASK_OUTPUT_MISSING_ID_MESSAGE, TASK_STOP_MISSING_ID_MESSAGE, TASK_STOP_PARAMS, resolveTaskIdArg, REGISTRY_TASK_TOOL_CAPS, composeTaskOutputDescription, composeTaskOutputParams, composeTaskStopDescription, } from "./task-tool-shape.js";
-import { durableAgentArmedLane, durableAgentRowProbeLane, beginDurableClaimLane, endDurableClaimLane, reapDurableAgentsLane, noteBackgroundAgentActivityLane, reapStaleSessionBackgroundAgentsLane, releaseDurableTranscriptAnchorLane, bindBackgroundAgentSessionLane, registerBackgroundAgentLane, parkBackgroundAgentLane, reconcileParkedAgentsLane, claimParkedAgentLane, rollbackParkedClaimLane, consumeParkedFlipLane, finalizeParkedResumeLane, settleBackgroundAgentLane, abortBackgroundAgentsForOwnerLane, serveDurableAgentRowLane, resolveBackgroundAgentByNameLane, markRetainedContinuationLane, reviveBackgroundAgentLane, settleRevivedAgentLane, unmarkRetainedContinuationLane, attachAgentNotifyLane, deliverToRunningAgentLane, runningBackgroundAgentLabelsLane, runningAgentFooterLane, notFoundRunningAgentsTail, pollBackgroundAgentLane, stopBackgroundAgentLane, } from "./task-registry-agent.js";
+import { durableAgentArmedLane, durableAgentRowProbeLane, beginDurableClaimLane, endDurableClaimLane, reapDurableAgentsLane, noteBackgroundAgentActivityLane, reapStaleSessionBackgroundAgentsLane, releaseDurableTranscriptAnchorLane, bindBackgroundAgentSessionLane, registerBackgroundAgentLane, recordBackgroundAgentOrgAdmissionLane, parkBackgroundAgentLane, reconcileParkedAgentsLane, claimParkedAgentLane, rollbackParkedClaimLane, consumeParkedFlipLane, finalizeParkedResumeLane, settleBackgroundAgentLane, abortBackgroundAgentsForOwnerLane, serveDurableAgentRowLane, resolveBackgroundAgentByNameLane, markRetainedContinuationLane, reviveBackgroundAgentLane, settleRevivedAgentLane, unmarkRetainedContinuationLane, attachAgentNotifyLane, deliverToRunningAgentLane, runningBackgroundAgentLabelsLane, runningAgentFooterLane, notFoundRunningAgentsTail, pollBackgroundAgentLane, stopBackgroundAgentLane, } from "./task-registry-agent.js";
 export { canAccessWorkflowRun, clipTaskOutput, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE };
 const BLOCK_DEFAULT_TIMEOUT_MS = 30_000;
 const BLOCK_MAX_TIMEOUT_MS = 600_000;
@@ -146,6 +146,9 @@ export class TaskRegistry {
     registerBackgroundAgent(input) {
         return registerBackgroundAgentLane(this.core, input);
     }
+    recordBackgroundAgentOrgAdmission(id, verdict) {
+        return recordBackgroundAgentOrgAdmissionLane(this.core, id, verdict);
+    }
     parkBackgroundAgent(id, park) {
         return parkBackgroundAgentLane(this.core, id, park);
     }

package/dist/core/task-tool-shape.js

@@ -39,8 +39,9 @@ export function composeTaskOutputDescription(caps) {
     }
     parts.push("Retrieve output or status for a background task by task_id. ");
     parts.push(caps.lanes
-        ? "Supports background Bash tasks and workflow tasks returned by RunWorkflow. Returns only the caller's own task scope; unknown and out-of-scope ids are " +
-            "reported the same way. "
+        ?
+            "Supports background Bash tasks and workflow tasks returned by Workflow. Returns only the caller's own task scope; unknown and out-of-scope ids are " +
+                "reported the same way. "
         : "Reads a background shell started with Bash(run_in_background): returns the run status (running / exited(code) / killed / failed) plus NEW stdout/stderr since your last call. ");
     if (!caps.notification) {
         parts.push('When using a background command as a wait condition, call this repeatedly until status is no longer "running" — completion ' +
@@ -64,7 +65,7 @@ export function composeTaskOutputParams(caps) {
     return Type.Object({
         task_id: Type.Optional(Type.String({
             description: caps.lanes
-                ? "The task_id returned by Bash(run_in_background) or RunWorkflow."
+                ? "The task_id returned by Bash(run_in_background) or Workflow."
                 : "The task_id returned by Bash(run_in_background).",
         })),
         ...(caps.blockWait

package/dist/core/tool-policy.d.ts

@@ -80,12 +80,17 @@ export interface AskRequest {
     toolCallId: string;
     args: unknown;
     readonly preview?: unknown;
+    readonly boundInputHash?: string;
     message: string;
     readonly principal?: string;
     readonly sourceTaskId?: string;
     readonly fromSubagent?: true;
     readonly sourceAgentName?: string;
     readonly requiresRealApproval?: boolean;
+    readonly riskAxes?: {
+        readonly irreversible?: boolean;
+        readonly egress?: boolean;
+    };
     readonly delegation?: AskDelegationProvenance;
 }
 export type OnAsk = "deny" | "allow" | ((req: AskRequest, signal?: AbortSignal) => AskOutcome | Promise<AskOutcome>);

package/dist/core/tool-policy.js

@@ -1,6 +1,7 @@
 import { homedir } from "node:os";
 import { isAbsolute, join, normalize as normalizePath, sep } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
+import { boundInputHashOf } from "./canonical-json.js";
 import { writeTargetPath } from "../tools/fs/safety.js";
 export function decisionText(d) {
     return d.message;
@@ -606,7 +607,7 @@ export async function resolveAsk(req, onAsk, signal) {
                 decisionReason: "mode",
             };
         }
-        ok = await onAsk({ ...req, args: approverView.value }, signal);
+        ok = await onAsk({ ...req, boundInputHash: boundInputHashOf(presented.value), args: approverView.value }, signal);
     }
     catch (err) {
         return {

package/dist/core/trace.d.ts

@@ -9,6 +9,11 @@ export interface TraceMechanismsSummary {
     repetitionCuts?: number;
     repetitionSpared?: number;
 }
+export interface ToolDisclosureManifest {
+    deferredTools: number;
+    strategy: "swap" | "static";
+    source: "spec" | "env" | "default" | "degraded_no_direct_lane";
+}
 export type TraceEvent = {
     kind: "task.start";
     version: 1;
@@ -47,6 +52,7 @@ export type TraceEvent = {
         form: string;
         intentionalDivergences: readonly string[];
     };
+    toolDisclosure?: ToolDisclosureManifest;
     ts: number;
 } | {
     kind: "prompt.snapshot_changed";