@sema-agent/core 5.17.0-pre.0 → 5.18.0

package/CHANGELOG.md

@@ -1,6 +1,191 @@
 # Changelog
 
-## 5.17.0 — 2026-08-08
+## 5.18.0 — 2026-08-10
+
+> Two mainline features land together: design/178 personal-assistant memory v1 (the retrieval pair
+> and its safety spine) and design/179 persisted permission rules v1 (the "don't ask again" lane).
+> Plus the TOC field-report fixes and the compaction/timeout honesty batch that accumulated on main.
+
+### design/178 — personal-assistant memory v1 (additive)
+
+- **`memory_search` + `memory_get`** mount as an atomic pair when a deployment wires a memory spec
+  (no spec = no tools = byte-identical behavior). Search returns scored, scope-contained results
+  across planes; get returns full entries under an explicit byte budget with honest
+  remainder disclosure. Retrieval is recorded (a usage account, collect-only in v1).
+- **Content-origin classification (fail-closed)**: every mounted tool is classified
+  local/protocol/external; unknown ⇒ external. External content entering the transcript flips the
+  session into a **one-way polluted state**; a polluted session's harvest is quarantined, not
+  ingested.
+- **Delegation is judged per call** by the delegated child's own statically-knowable tool pool: a
+  child that can reach external tools (or re-delegate to one that can) marks the parent session on
+  result return; a purely local child leaves memory fully live. Unknown/unresolvable child ⇒
+  fail-closed external.
+- **The retrieval face never writes**: `memory_search`/`memory_get` read through a no-ingest view
+  (`retrievalView()` on the file backend) — a model-triggered read can no longer launder
+  out-of-band file edits into the ledger (the polluted-session laundering hole found in review).
+- Containment/restore writes go through `O_NOFOLLOW` + write-through-fd (leaf-segment symlink
+  refusal; the ancestor-directory window is honestly registered, not claimed).
+- Sync push runs the shared secret/size scan set; `maxEntryBytes` is validated (NaN/Infinity no
+  longer silently remove the cap).
+
+### design/179 — persisted permission rules v1
+
+- **The allow-rule lane**: wire a `PermissionRuleStoreProvider` and a human-approved rule
+  (`Bash(git status)` exact / `Bash(git status:*)` word-boundary prefix) resolves the plain asks it
+  matches — post-fold, before the classifier, never inside the policy fold. Consumption predicate
+  (all three required): the decision is an `ask`, it does not carry `requiresRealApproval`
+  (the two integrity gates stay untouchable), and it is not hook-minted. Every rule-resolved allow
+  carries `decisionReason: "persisted_rule"`.
+- **Consent protocol**: rules enter the store ONLY through redemption of a durable approval record
+  (ask-card single approvals, the CC settings importer, and the starter batch share one protocol);
+  one redemption mints exactly one dot; replay is idempotent. `removePersistedRule` is the
+  host-callable tighten-direction removal (no ceremony; tombstone-identity retries).
+- **Shell constructs are never rule-resolved** (pipes, redirections, substitutions, compounds —
+  fail-closed to the existing chain); rules match single plain commands only, per tool.
+- **CC settings importer** reads the three user-editable layers and structurally reports the
+  flag/policy layers as not imported (`uncovered`, always present). Starter batch is consent-gated.
+- Defaults: storeless deployments are byte-identical to 5.17.0 (golden-pinned), and wiring a store
+  does not silence the ungated-write warning. The wiring manifest gains
+  `permissionRules.storeWired`.
+
+### BREAKING
+
+- **`decisionReason` closed set gains `"persisted_rule"`** — consumers pinning the enum must re-pin.
+- **`confirmRuleApproval` requires `selectedCandidate`** (the card's rules come from the engine;
+  a host cannot submit free-text rules).
+- **`prepareCardApproval` no longer accepts caller candidates** (engine-minted only).
+- **`createAllowDenyPolicy` throws `config.invalid_tool_name_set` by default** on names that can
+  never match (retired names, CC content-form entries like `Bash(ps:*)`, bad MCP forms) instead of
+  silently narrowing the tool out of the whitelist — the silent-Bash-loss class the field report
+  found. `onInvalidName: "skip"` opts back into discard-with-disclosure.
+- Behavior narrowed (was 5.17.x): generated prefix *suggestions* are withdrawn (exact-command
+  suggestions only); a rule speaks only for its own tool; the file store write face takes a
+  process-wide lock.
+
+### Fixed
+
+- **Compaction**: an unevaluable context window (unknown/zero/null `contextWindow`) is a disclosed
+  state on every lane — including the end-of-task-only lane — instead of a silent `false`; a null
+  window value now takes the nothing-declared remedy.
+- **Bash timeout plateau**: the sub-1.5s collapse is stated on the card from the same caps the
+  runtime enforces, minted once for both shell legs; a cap pair inside the plateau states the floor
+  instead of promising "1500+ for longer"; the config leg's discard warning names the value.
+- Canonical-JSON internals drop double-jump casts (hash-neutral, byte-pinned).
+- Truncation-invariant surface: two review-sampling legs registered as exempt (layered sampling
+  with unconditional tail window).
+
+### Docs / registry
+
+- Backlog #99–#104 recorded (deadline verdicts, classifier-guard REFUTED with corpus anchors,
+  models-hint truth, memory_get cursor v2, BootLock takeover, containment write family).
+
+## 5.17.0 — 2026-08-09
+
+> One release, three campaigns: design/176 peer guard + design/177 shared memory stores (below, from
+> the first RC), the error-surface re-anchor batch, and the durable-approval honesty tail
+> (capture/fidelity/seat-criterion). The re-verified RC supersedes `c48e66d`.
+
+### BREAKING — model-visible error text re-anchored
+
+- **Validation failure is a synthesized sentence, not a dump.** A tool-argument validation error now
+  reads as classified one-line findings (missing / unexpected / type-mismatched parameters, other
+  issues listed with a 2,000-char cap) — and **the full argument echo is gone** (the failed call sits
+  immediately above its result in the transcript; the echo was a verbatim second copy, paid once per
+  retry). The schema re-teach section stays, capped at 4,000 chars (an intentional divergence: a BYOM
+  model benefits from re-teaching). Tests pinning the old `Received arguments:` form must re-pin.
+- **Every loop-minted error text is bounded.** `createErrorToolResult` runs the same 10k head+tail
+  truncation the tool-throw path already had — the tool-not-found, abort, hook/policy-text,
+  harness-throw and after-tool-note arms are no longer unbounded.
+- **The tool-not-found roster lists ≤25 names** (`… and N more`, with a ToolSearch pointer when
+  mounted) instead of the whole roster.
+- **Repeated interruption stubs collapse**: within one reconcile batch, the 2nd..nth orphaned call of
+  the same class gets a one-line back-reference instead of the full boilerplate.
+- An MCP error's `structuredContent` is no longer appended when its JSON already appears in the text
+  parts; an ambiguous-Edit refusal echoes at most 200 chars of the needle; four repeated guidance
+  sentences are single-sourced (model-visible bytes unchanged).
+- **The per-read content-safety reminder is gated** (`readCyberReminder` on the hands band / toolkit
+  options): default ON (injected after every text read, as before), explicit `false` for deployments
+  whose model carries this mitigation natively.
+
+### BREAKING — durable approval rows filed at backend width
+
+- The park mint files arguments at the width its checkpoint backend can hold. `CheckpointStore` gains
+  the third honest-declaration axis `fidelity` (`"structured-clone" | "json"`; ABSENT reads
+  fail-closed as `"json"`); the row's args, preview, risk descriptor and opaque `boundInputHash` are
+  minted from the backend's projection, so what an approver sees, what is on disk and what a resume
+  executes are one value. Arguments with no JSON encoding (BigInt, a cycle) are refused at the mint,
+  naming the backend. A projection that moves the value is re-adjudicated against the deployment's
+  policy; a deny — or a rewrite naming anything else — refuses the park and falls back to the
+  synchronous gate. `StoreFidelity` is exported.
+  **Upgrade note:** rows minted by earlier versions keep their pre-projection hash and already-degraded
+  arguments; drain pending approvals (approve/deny them) before upgrading, or accept the old semantics
+  on those rows.
+
+### Changed
+
+- **Model-visible text (four faces) now states what this engine actually does.** Each is a string the
+  model reads, so a deployment pinning these bytes must re-pin:
+  1. `tool_search_usage_reminder` no longer ends with "Calling a tool before its schema is loaded will
+     fail." With the RB-403 direct-call lane mounted — the DEFAULT (`TaskSpec.deferSelfResolve` not
+     disabled) — a call whose arguments match the real schema executes, so the absolute claim was false
+     for that posture. The default posture now reads "You do not have these tools' parameters, so
+     activate one rather than guessing its arguments."; the absolute wording is retained only under
+     `deferSelfResolve: false`, where it is exactly true. Same amendment DD-5 already made to the
+     sibling ToolSearch description.
+  2. `tools_delta`'s static `added` arm attributes schemas to "the tool result that activated them"
+     instead of "the ToolSearch result". Under `toolMaterializeStrategy: "static"` the direct-call lane
+     is always mounted, so an announced tool may have been activated with no ToolSearch result in
+     existence at all.
+  3. `AskUserQuestion`'s description is posture-conditional. Under `interactionPosture: "interactive"`
+     without `interactiveQuestionFallback`, both no-answer arms are coded failures, so the description
+     states that instead of promising "you will be told to proceed with your best judgment".
+  4. The deferred-orchestration prompt block no longer promises "the full contract arrives with it" —
+     under the static face only the parameter schema materializes, never the tool's description.
+
+### Fixed
+
+- **A durable park that cannot capture its arguments now says so, instead of leaving the call to report
+  a missing approver.** Arguments a `structuredClone` cannot copy — a hook/policy rewrite handing over a
+  function, a symbol, a live handle; model arguments are JSON, so the deployment is the only source —
+  used to reach the checkpoint store and throw a `DataCloneError` from inside `put`. That failure went to
+  `onError` alone, the park reported "not suspended", and the fallback chain's headless auto-deny told
+  the model and the `permissionDenied` observer that no approver was wired: true, and about a different
+  subject than the one that stopped the call. The park leg now checks capturability before any side
+  effect (with the same helper the synchronous approval boundary uses), refuses with the runtime's own
+  sentence, and never enters the store. A park attempt that fails for any reason carries its cause to
+  the gate, which appends it to whatever deny the fallback produces — the fallback itself, and the
+  compensation contract behind it, are unchanged. Three narrowings ride along: arguments carrying shared
+  memory (`SharedArrayBuffer`) are refused at the mint rather than filed as a row another holder can
+  still mutate; the row stores the checked snapshot, so its arguments, preview and binding hash describe
+  one reading rather than one per consumer; and a park that already made its one real attempt is not
+  asked again when the approver then reports unavailable (a suspend and a checkpoint write are not
+  idempotent — the invariant the content-ask lane already states, now held on the permission lane too).
+  Refusal text quoting a thrown value is neutralized and bounded on its way to the model, since a clone
+  error renders the offending value's own source into its message; the exception itself still reaches
+  `onError` with its type and stack intact.
+- **BREAKING (narrow) — the child-chain durable-approval mandate uses the same seat criterion as the
+  task's own gate, single-sourced.** A blanket `onAsk: "allow"`/`"deny"` is a policy setting, not a
+  live approver — the parent's gate already said so; the inherited-constraint leg still read a string
+  seat as occupied. One predicate now serves both sites. The reachable defect was in the storeless
+  rows: with `durableApproval` configured but no `CheckpointStore`, a child under a blanket `"allow"`
+  chain entry EXECUTED side-effecting calls the parent's own gate would not have resolved through that
+  blanket. Such a child now parks with its own facility or denies fail-closed. (The store remains the
+  park lane's arming condition — it is just no longer misread as part of the seat.)
+- **`wiring-manifest` no longer reports an auto verdict for runs whose asks park.** `deriveAskEffective`
+  returns `park_only` for a blanket `"allow"`/`"deny"` seat on an armed park lane. Operator/governance
+  projection only; the interaction-posture door is unaffected (it tests `human_reachable` alone).
+- **A revived background agent no longer inherits the previous cycle's stop attribution.**
+  `reviveBackgroundAgentLane` clears `stoppedBy` in lockstep with the durable row's cleared-field set:
+  cycle 2's running and completed polls were reporting cycle 1's stopper while the durable-row lane
+  reported none, and cycle 2's real stopper was discarded in favour of cycle 1's.
+- **Three CI discipline gates that had been red on every push are green.** `gate:field-liveness` (the
+  managed-retention contract never got allowlist rows), `gate:message-branching` and
+  `gate:domain-lexicon` (one false positive each, both narrowed rather than allowlisted). The step
+  aborts on first failure, so the six gate test files after it had not been running either.
+- **The `eval/` and `bench/memory-write-channel` harnesses run again.** Both failed at task start on
+  config keys retired in 5.8.0 (`limits.timeoutSec`) and 2.0.0 (`memory: { scope }`) and reported it
+  only as a score of zero. `eval/` now runs 5/5 offline as its README claims, and joins `tsconfig`'s
+  include so the class reds `tsc` instead of rotting silently (the build config is unaffected).
 
 ### Added
 

package/dist/agents/subagent.d.ts

@@ -9,6 +9,14 @@ import { SubagentRetainLedger } from "./retain-ledger.js";
 import { type PeerSelfRef } from "./peer-admission.js";
 export type { SubagentStep, SubagentEditedFile } from "./subagent-steps.js";
 export declare function notifyResultField(result: string | undefined): string | undefined;
+interface ReviewSample {
+    text: string;
+    readChars: number;
+    totalChars: number;
+    sampled: boolean;
+    gaps: number;
+}
+export declare function layeredReviewSample(text: string, budget?: number, windows?: number): ReviewSample;
 export declare function inheritedManifestScopeFor(snapshot: readonly unknown[] | undefined): RunInternals["inheritedManifestScope"];
 export declare const DEFAULT_SUBAGENT_TOOL_NAME = "Agent";
 export declare const EXTRA_TOOLS_MAX_FACTORY_CALLS_PER_TREE = 64;

package/dist/agents/subagent.js

@@ -55,6 +55,66 @@ export function notifyResultField(result) {
         ? `${result.slice(0, BG_AGENT_NOTIFY_RESULT_MAX)}\n[result truncated: ${result.length} chars total — call TaskOutput for the full text]`
         : result;
 }
+const HANDBACK_REVIEW_SAMPLE_BUDGET = 12_000;
+const HANDBACK_REVIEW_SAMPLE_WINDOWS = 5;
+const HANDBACK_REVIEW_SAMPLE_MAX_WINDOWS = 16;
+const HANDBACK_REVIEW_MARKER_COST = 32;
+const REVIEW_MARKER_SCAR = String.fromCharCode(0xff3b);
+function defuseGapMarkers(slice) {
+    return slice.replace(/\[…/g, `${REVIEW_MARKER_SCAR}…`);
+}
+function surrogateSafeSlice(text, from, width, anchorEnd = false) {
+    const isLow = (i) => text.charCodeAt(i) >= 0xdc00 && text.charCodeAt(i) <= 0xdfff;
+    const isHigh = (i) => text.charCodeAt(i) >= 0xd800 && text.charCodeAt(i) <= 0xdbff;
+    let start = from;
+    if (start > 0 && start < text.length && isLow(start) && isHigh(start - 1))
+        start--;
+    if (anchorEnd)
+        return { text: text.slice(start), start, end: text.length };
+    let end = Math.min(start + width, text.length);
+    if (end > start && end < text.length && isHigh(end - 1) && isLow(end))
+        end--;
+    return { text: text.slice(start, end), start, end };
+}
+export function layeredReviewSample(text, budget = HANDBACK_REVIEW_SAMPLE_BUDGET, windows = HANDBACK_REVIEW_SAMPLE_WINDOWS) {
+    const total = text.length;
+    const budgetChars = Number.isFinite(budget) ? Math.max(4, Math.floor(budget)) : HANDBACK_REVIEW_SAMPLE_BUDGET;
+    if (total <= budgetChars)
+        return { text, readChars: total, totalChars: total, sampled: false, gaps: 0 };
+    const requested = Number.isFinite(windows) ? Math.floor(windows) : HANDBACK_REVIEW_SAMPLE_WINDOWS;
+    const count = Math.max(2, Math.min(Math.max(2, requested), HANDBACK_REVIEW_SAMPLE_MAX_WINDOWS, Math.floor(budgetChars / HANDBACK_REVIEW_MARKER_COST)));
+    const size = Math.floor(budgetChars / count);
+    const span = total - size;
+    const parts = [];
+    let readChars = 0;
+    let prevEnd = 0;
+    let gaps = 0;
+    for (let i = 0; i < count; i++) {
+        const start = Math.round((span * i) / (count - 1));
+        const slice = surrogateSafeSlice(text, start, size, i === count - 1);
+        if (i > 0 && slice.start > prevEnd) {
+            parts.push(`\n[… ${slice.start - prevEnd} chars not shown …]\n`);
+            gaps++;
+        }
+        parts.push(defuseGapMarkers(slice.text));
+        readChars += slice.text.length;
+        prevEnd = slice.end;
+    }
+    const out = parts.join("");
+    if (out.length >= total)
+        return { text, readChars: total, totalChars: total, sampled: false, gaps: 0 };
+    return { text: out, readChars, totalChars: total, sampled: true, gaps };
+}
+function reviewCoverageNote(fields) {
+    const sampled = fields.filter((f) => f.sample.sampled);
+    if (sampled.length === 0)
+        return undefined;
+    return (sampled
+        .map((f) => `${f.field}: the classifier was shown ${f.sample.readChars} of ${f.sample.totalChars} characters (UTF-16 code units) ` +
+        `(layered head/middle/tail sample; the ${f.sample.gaps} skipped span(s) are marked in place as ` +
+        `"[… N chars not shown …]" — any further such marker in the text is the child's own writing, not this sampler's)`)
+        .join("; ") + " — the unshown spans were NOT reviewed; treat them as unknown, not as benign.");
+}
 const HANDBACK_ASK_MESSAGE = "Subagent has finished and is handing back control to the main agent. Review the subagent's work and flag if any action may violate security policy.";
 async function reviewHandback(opts) {
     const { review, evidence, signal } = opts;
@@ -64,15 +124,22 @@ async function reviewHandback(opts) {
         return undefined;
     if (!evidence.result && !evidence.steps && !evidence.edits && !evidence.partialText)
         return undefined;
+    const resultSample = evidence.result ? layeredReviewSample(evidence.result) : undefined;
+    const partialSample = evidence.partialText ? layeredReviewSample(evidence.partialText) : undefined;
+    const coverage = reviewCoverageNote([
+        ...(resultSample ? [{ field: "result", sample: resultSample }] : []),
+        ...(partialSample ? [{ field: "partialFindings", sample: partialSample }] : []),
+    ]);
     const verdict = await review.decider
         .decide({
         req: {
             toolName: opts.toolName,
             args: {
-                result: evidence.result?.slice(0, 2_000),
+                result: resultSample?.text,
                 toolSteps: evidence.steps,
                 editedFiles: evidence.edits,
-                ...(evidence.partialText ? { partialFindings: evidence.partialText.slice(0, 2_000) } : {}),
+                ...(partialSample ? { partialFindings: partialSample.text } : {}),
+                ...(coverage ? { reviewCoverage: coverage } : {}),
             },
             toolCallId: opts.toolCallId,
         },
@@ -933,9 +1000,33 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 }]
             : []),
     ];
+    const delegationToolName = opts.name ?? DEFAULT_SUBAGENT_TOOL_NAME;
+    const depthPermitsNesting = depth + 1 < maxDepth;
+    const agentToolFaces = [
+        ...(generalPurposeShadowed ? [] : [{ name: GENERAL_PURPOSE_SUBAGENT_TYPE, ...(depthPermitsNesting ? { canRedelegate: true } : {}) }]),
+        ...available.map((a) => ({
+            name: a.name,
+            ...(a.allowTools !== undefined ? { allowTools: a.allowTools } : {}),
+            ...(a.denyTools !== undefined ? { denyTools: a.denyTools } : {}),
+            ...(depthPermitsNesting && toolNameAllowed(delegationToolName, a.allowTools, a.denyTools) ? { canRedelegate: true } : {}),
+        })),
+        ...(forkOffered ? [{ name: FORK_SUBAGENT_TYPE, ...(depthPermitsNesting ? { canRedelegate: true } : {}) }] : []),
+    ];
+    const agentToolPool = opts.extraTools !== undefined
+        ? undefined
+        : (opts.tools ?? []).map((t) => ({
+            name: t.name,
+            ...(t.aliases !== undefined ? { aliases: t.aliases } : {}),
+            ...(t.contentOrigin !== undefined
+                ? { contentOrigin: t.contentOrigin }
+                : {}),
+        }));
     return {
         name: opts.name ?? DEFAULT_SUBAGENT_TOOL_NAME,
         agentListing,
+        agentToolFaces,
+        ...(agentToolPool !== undefined ? { agentToolPool } : {}),
+        contentOrigin: "local",
         ...(rosterNames !== undefined ? { agentModels: rosterNames } : {}),
         executionMode: "parallel",
         contract: { contractId: "core.agent@1", implementationRevision: "1" },

package/dist/core/ask-question.js

@@ -174,7 +174,12 @@ export function createAskUserQuestionTool(onQuestion, source, opts) {
         description: "Ask the user a structured multiple-choice question when you are genuinely stuck or a decision is " +
             "the user's to make (which approach, which of these). Provide 1-4 questions, each with 2-4 options " +
             "(label + description). Use sparingly — not for anything you can determine yourself from the code or " +
-            "the task. If no human is available you will be told to proceed with your best judgment.\n" +
+            "the task. " +
+            (onQuestion !== undefined && opts?.posture === "interactive" && opts.interactiveFallback !== true
+                ? "If no human can be reached this call FAILS with a coded error — do not plan around being told to " +
+                    "proceed with your best judgment."
+                : "If no human is available you will be told to proceed with your best judgment.") +
+            "\n" +
             "\n" +
             "Usage notes:\n" +
             '- Users will always be able to select "Other" to provide custom text input\n' +

package/dist/core/auto-compaction.d.ts

@@ -125,6 +125,12 @@ export declare function maybeCompact(opts: MaybeCompactOptions): Promise<{
         estTokens: number;
         floor: number;
     };
+    unevaluableWindow?: {
+        estTokens: number;
+        windowField: "autoCompactTokens" | "contextTokens" | "contextWindow";
+        windowValue?: number;
+        modelId?: string;
+    };
     contextUsage?: {
         usedTokens: number;
         windowTokens: number;

package/dist/core/auto-compaction.js

@@ -69,6 +69,7 @@ export async function maybeCompact(opts) {
     const tokens = anchorStale || est.usageTokens === 0 ? structuralTokens + overhead : est.tokens;
     const window = opts.model.autoCompactTokens ?? opts.model.contextTokens ?? opts.model.contextWindow;
     const windowKnown = Number.isFinite(window) && window > 0;
+    const windowField = opts.model.autoCompactTokens != null ? "autoCompactTokens" : opts.model.contextTokens != null ? "contextTokens" : "contextWindow";
     const settings = sanitizeCompactionSettings(rawSettings, window);
     const contextUsage = windowKnown
         ? { usedTokens: tokens, windowTokens: window, compactAtTokens: window - settings.reserveTokens }
@@ -80,7 +81,20 @@ export async function maybeCompact(opts) {
         if (wantsCompact) {
             return { contextUsage, compacted: false, suppressedByFloor: { estTokens: tokens, floor: opts.minTokens ?? 0 } };
         }
-        return { contextUsage, compacted: false };
+        return {
+            contextUsage,
+            compacted: false,
+            ...(windowKnown
+                ? {}
+                : {
+                    unevaluableWindow: {
+                        estTokens: tokens,
+                        windowField,
+                        ...(typeof window === "number" ? { windowValue: window } : {}),
+                        ...(opts.model.id !== undefined ? { modelId: opts.model.id } : {}),
+                    },
+                }),
+        };
     }
     const branch = await opts.session.getBranch();
     const prep = prepareCompaction(branch, settings, cpt, window);

package/dist/core/canonical-json.js

@@ -39,20 +39,10 @@ function encode(value, depth = 0) {
                         out += encode(el, depth + 1);
                     return `${out}]`;
                 }
-                const obj = value;
-                const keys = Object.keys(obj).sort();
-                let out = `o${keys.length}:{`;
-                for (const k of keys) {
-                    let encoded;
-                    try {
-                        encoded = encode(obj[k], depth + 1);
-                    }
-                    catch {
-                        encoded = "<unreadable-property>";
-                    }
-                    out += `${Buffer.byteLength(k, "utf8")}:${k}=${encoded}`;
-                }
-                return `${out}}`;
+                const branded = encodeBranded(value, depth);
+                if (branded !== undefined)
+                    return branded;
+                return encodeOwnKeys(value, depth);
             }
             catch {
                 return "<unserializable>";
@@ -62,6 +52,178 @@ function encode(value, depth = 0) {
             return "U";
     }
 }
+function encodeOwnKeys(source, depth, skipIndicesBelow = 0) {
+    const obj = source;
+    const all = Object.keys(obj);
+    const keys = (skipIndicesBelow > 0 ? all.filter((k) => !isIndexBelow(k, skipIndicesBelow)) : all).sort();
+    let out = `o${keys.length}:{`;
+    for (const k of keys) {
+        let encoded;
+        try {
+            encoded = encode(obj[k], depth + 1);
+        }
+        catch {
+            encoded = "<unreadable-property>";
+        }
+        out += `${Buffer.byteLength(k, "utf8")}:${k}=${encoded}`;
+    }
+    return `${out}}`;
+}
+function isIndexBelow(key, limit) {
+    const n = Number(key);
+    return Number.isInteger(n) && n >= 0 && n < limit && String(n) === key;
+}
+function brandOf(value) {
+    try {
+        const s = Object.prototype.toString.call(value);
+        return s.startsWith("[object ") && s.endsWith("]") ? s.slice(8, -1) : "Object";
+    }
+    catch {
+        return "Object";
+    }
+}
+function encodeBranded(value, depth) {
+    const brand = brandOf(value);
+    if (brand === "Object")
+        return undefined;
+    if (ArrayBuffer.isView(value)) {
+        try {
+            const { buffer, byteOffset, byteLength, elements, family } = viewRange(value);
+            const bytesToken = digestBytes(new Uint8Array(buffer, byteOffset, byteLength));
+            return `V:${family}:${brand}:${byteLength}:${bytesToken}${encodeOwnKeys(value, depth, elements)}`;
+        }
+        catch {
+        }
+    }
+    const own = encodeOwnKeys(value, depth);
+    try {
+        switch (brand) {
+            case "Date": {
+                const t = Date.prototype.getTime.call(value);
+                return `D:${Number.isNaN(t) ? "Invalid" : encodeNumber(t)}${own}`;
+            }
+            case "Map": {
+                const size = Number(mapSizeGetter.call(value));
+                let out = `m${size}:{`;
+                let seen = 0;
+                for (const [k, v] of mapEntries.call(value)) {
+                    if (seen++ >= size)
+                        break;
+                    out += `${encode(k, depth + 1)}=${encode(v, depth + 1)}`;
+                }
+                return `${out}}${own}`;
+            }
+            case "Set": {
+                const size = Number(setSizeGetter.call(value));
+                let out = `t${size}:[`;
+                let seen = 0;
+                for (const v of setValues.call(value)) {
+                    if (seen++ >= size)
+                        break;
+                    out += encode(v, depth + 1);
+                }
+                return `${out}]${own}`;
+            }
+            case "RegExp": {
+                const source = String(regexpSourceGetter.call(value));
+                const flags = String(regexpFlagsGetter.call(value));
+                return `r${Buffer.byteLength(source, "utf8")}:${source}/${flags}${own}`;
+            }
+            case "Error": {
+                const name = String(value.name);
+                const message = String(value.message);
+                return `E${Buffer.byteLength(name, "utf8")}:${name}:${Buffer.byteLength(message, "utf8")}:${message}${own}`;
+            }
+            case "URL": {
+                const href = String(urlHrefGetter.call(value));
+                return `L${Buffer.byteLength(href, "utf8")}:${href}${own}`;
+            }
+            case "Boolean":
+            case "Number":
+            case "String":
+            case "BigInt":
+            case "Symbol": {
+                const unboxed = boxedValueOf[brand].call(value);
+                return `B:${encode(unboxed, depth + 1)}${own}`;
+            }
+            case "ArrayBuffer":
+            case "SharedArrayBuffer": {
+                const byteLength = Number((brand === "ArrayBuffer" ? arrayBufferByteLengthGetter : sharedArrayBufferByteLengthGetter).call(value));
+                return `A:${brand}:${byteLength}:${digestBytes(new Uint8Array(value))}${own}`;
+            }
+            default:
+                break;
+        }
+    }
+    catch {
+    }
+    return `x${Buffer.byteLength(brand, "utf8")}:${brand}${own}`;
+}
+function primordialGetter(proto, key) {
+    const get = Object.getOwnPropertyDescriptor(proto, key)?.get;
+    if (!get) {
+        return () => {
+            throw new Error(`no primordial getter for ${key}`);
+        };
+    }
+    return get;
+}
+const mapEntries = Map.prototype.entries;
+const setValues = Set.prototype.values;
+const mapSizeGetter = primordialGetter(Map.prototype, "size");
+const setSizeGetter = primordialGetter(Set.prototype, "size");
+const regexpSourceGetter = primordialGetter(RegExp.prototype, "source");
+const regexpFlagsGetter = primordialGetter(RegExp.prototype, "flags");
+const urlHrefGetter = primordialGetter(URL.prototype, "href");
+const arrayBufferByteLengthGetter = primordialGetter(ArrayBuffer.prototype, "byteLength");
+const sharedArrayBufferByteLengthGetter = typeof SharedArrayBuffer !== "undefined"
+    ? primordialGetter(SharedArrayBuffer.prototype, "byteLength")
+    : primordialGetter({}, "byteLength");
+const boxedValueOf = {
+    Boolean: Boolean.prototype.valueOf,
+    Number: Number.prototype.valueOf,
+    String: String.prototype.valueOf,
+    BigInt: BigInt.prototype.valueOf,
+    Symbol: Symbol.prototype.valueOf,
+};
+const typedArrayProto = Object.getPrototypeOf(Uint8Array.prototype);
+const typedArrayLengthGetter = primordialGetter(typedArrayProto, "length");
+const viewGetters = {
+    typed: {
+        buffer: primordialGetter(typedArrayProto, "buffer"),
+        byteOffset: primordialGetter(typedArrayProto, "byteOffset"),
+        byteLength: primordialGetter(typedArrayProto, "byteLength"),
+    },
+    dataView: {
+        buffer: primordialGetter(DataView.prototype, "buffer"),
+        byteOffset: primordialGetter(DataView.prototype, "byteOffset"),
+        byteLength: primordialGetter(DataView.prototype, "byteLength"),
+    },
+};
+function viewRange(view) {
+    for (const family of ["typed", "dataView"]) {
+        const g = viewGetters[family];
+        try {
+            const range = {
+                buffer: g.buffer.call(view),
+                byteOffset: Number(g.byteOffset.call(view)),
+                byteLength: Number(g.byteLength.call(view)),
+                elements: 0,
+                family,
+            };
+            if (family === "typed")
+                range.elements = Number(typedArrayLengthGetter.call(view));
+            return range;
+        }
+        catch {
+            continue;
+        }
+    }
+    throw new Error("not a readable ArrayBuffer view");
+}
+function digestBytes(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
 function encodeNumber(n) {
     if (Number.isNaN(n))
         return "NaN";

package/dist/core/checkpoint-store.d.ts

@@ -123,6 +123,7 @@ export type PendingAction = {
     toolName: string;
     args: unknown;
     preview?: unknown;
+    ruleSuggestions?: readonly import("./permission-rule-model.js").RuleSuggestion[];
     boundInputHash: string;
     batchToolCallIds: string[];
     completedCallIds: string[];
@@ -283,9 +284,22 @@ export declare class CheckpointError extends Error {
     } | undefined);
 }
 export type StoreDurability = "durable" | "process-local";
+export type StoreFidelity = "structured-clone" | "json";
+export declare function resolveDeclaredFidelity(store: {
+    readonly fidelity?: StoreFidelity;
+} | undefined, storeName: string): StoreFidelity;
+export declare function encodeAtFidelity(fidelity: StoreFidelity, value: unknown): {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    cause: unknown;
+};
+export declare function samePlainValue(a: unknown, b: unknown): boolean;
 export interface CheckpointStore {
     readonly retention?: import("./retention.js").RetentionDeclaration;
     readonly durability?: StoreDurability;
+    readonly fidelity?: StoreFidelity;
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
     get(token: CheckpointToken): Promise<Checkpoint | null>;
     resolve(token: CheckpointToken, scope: string, outcome: ResumeOutcome, expect?: ResolveExpectation): Promise<boolean>;
@@ -315,6 +329,7 @@ export type CheckpointFaultMode = "resolve-after-commit" | "resolve-before-commi
 export declare class InMemoryCheckpointStore implements CheckpointStore {
     readonly retention: "none";
     readonly durability: "process-local";
+    readonly fidelity: "structured-clone";
     private cps;
     private fault;
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;