@sema-agent/core 5.17.0-pre.0 → 5.18.0

package/dist/core/runner/prepare-task.js

@@ -20,7 +20,9 @@ import { createSubagentWorktreeHelper, forkGovernanceDenial } from "../../agents
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import { askApproverIdentity, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets } from "../tool-policy.js";
+import { askApproverIdentity, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
+const PERSISTED_RULE_TOOL = "Bash";
+import { findAdmittingRule, suggestRulesForCommand } from "../permission-rule-model.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
 import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentListingDelta } from "./turn-attachments.js";
 import { inlineUntrusted } from "../untrusted-text.js";
@@ -41,6 +43,9 @@ import { compileOutputSchema } from "./strict-output-schema.js";
 import { TOOL_SEARCH_NAME, buildDeferredRegistry, classifyDeferred, extractDiscoveredToolNames, createPlaceholderTool, createToolSearchTool, staticSchemaRenderable, } from "./tool-disclosure.js";
 import { createSharedMemoryTools } from "../shared-memory/tools.js";
 import { SHARED_MEMORY_TOOL_NAMES } from "../shared-memory/types.js";
+import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
+import { MEMORY_RECALL_DISCIPLINE } from "../memory-engine/engine.js";
+import { classifyToolContentOrigin, contentOriginPollutes, delegationCallIsExternal } from "../memory-engine/content-origin.js";
 import { composeMemoryBlock } from "../memory.js";
 import { preflightLockedConfig } from "../locked-config.js";
 import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, complianceCallDenial, resolveComplianceDenies } from "../compliance.js";
@@ -77,7 +82,7 @@ import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-
 import { createLspTool, gitCheckIgnoreFilter, resolveLspPath } from "../lsp.js";
 import { resolveKey } from "../../tools/fs/safety.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
-import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, remainingBudgetMicroUsd, resolveCheckpointStore, } from "../checkpoint-store.js";
+import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { countElicitOptIns, deriveAskEffective, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam } from "../wiring-manifest.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
@@ -168,6 +173,9 @@ export function resolveEnvLifetimeExpiry(env, observedAt) {
         return { unanchored: true };
     return { expiresAt: anchor + lifetimeMs };
 }
+function isLiveApproverSeat(onAsk) {
+    return typeof onAsk === "function";
+}
 const DEFAULT_UNATTENDED_APPROVAL_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 function sanitizedTtlMs(ttlMs) {
     if (ttlMs === undefined)
@@ -182,6 +190,12 @@ export const DEFAULT_IRREVERSIBLE_SCOPE = "irreversible";
 export function checkpointScopeOf(spec) {
     return spec.durableApproval?.scope || spec.principal || DEFAULT_IRREVERSIBLE_SCOPE;
 }
+class ParkRefusal extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "ParkRefusal";
+    }
+}
 export { resolveCheckpointStore } from "../checkpoint-store.js";
 export function isFableFamilyModelId(id) {
     const tail = id.toLowerCase().split("/").pop() ?? "";
@@ -1050,7 +1064,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(ownSessionRulesRef.current !== undefined ? [ownSessionRulesRef.current] : []),
             ];
             const ownCallerPolicy = lockedPreflight.toolPolicy;
-            const durableMandate = runtimeCaps?.forceDurableGate === true || (spec.durableApproval !== undefined && frozenOnAsk === undefined);
+            const durableMandate = runtimeCaps?.forceDurableGate === true ||
+                (spec.durableApproval !== undefined && !isLiveApproverSeat(frozenOnAsk));
             const parentConstraints = [
                 ...(inheritedParentConstraints ?? []),
                 ...(ownCallerPolicy !== undefined
@@ -1379,6 +1394,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         tools.push(...mcp.tools.map((t) => remoteToolOffload(t)));
         const rebuildHarnessToolsRef = {};
+        const contentOriginWrapRef = {};
         const toolCallGateArmedRef = { armed: false };
         if (lockedPreflight.mcp?.length) {
             tools.push({
@@ -1595,6 +1611,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(deps.hands?.commitCoAuthor !== undefined ? { commitCoAuthor: deps.hands.commitCoAuthor } : {}),
                 ...(deps.hands?.readImageDownsampler !== undefined ? { readImageDownsampler: deps.hands.readImageDownsampler } : {}),
                 ...(deps.hands?.autoBackgroundOnTimeout !== undefined ? { autoBackgroundOnTimeout: deps.hands.autoBackgroundOnTimeout } : {}),
+                ...(deps.hands?.readCyberReminder !== undefined ? { readCyberReminder: deps.hands.readCyberReminder } : {}),
                 beforeWrite: async (w) => {
                     const deploymentGate = deps.hands?.beforeWrite;
                     if (deploymentGate) {
@@ -1857,13 +1874,23 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     .catch(() => undefined);
             }
             : undefined;
-        const { memoryEngineSession, memoryBlock: memoryBlockFromEngine, seedFiles: memorySeedFiles, admittedOrgScopes: memoryAdmittedOrgScopes, ownOrgVerdict: memoryOwnOrgVerdict, } = await prepareMemory({
+        const memoryPairNameDomain = new Set();
+        for (const t of tools) {
+            memoryPairNameDomain.add(t.name);
+            for (const alias of t.aliases ?? [])
+                memoryPairNameDomain.add(alias);
+        }
+        const memoryPairExcludedName = MEMORY_ENGINE_TOOL_NAMES.find((n) => (toolFaceSnapshot.exclude ?? []).includes(n));
+        const memoryPairOccupiedName = MEMORY_ENGINE_TOOL_NAMES.find((n) => memoryPairNameDomain.has(n));
+        const memorySearchToolsPlanned = memoryPairExcludedName === undefined && memoryPairOccupiedName === undefined;
+        const { memoryEngineSession, memoryBlock: memoryBlockFromEngine, memoryTools, seedFiles: memorySeedFiles, admittedOrgScopes: memoryAdmittedOrgScopes, ownOrgVerdict: memoryOwnOrgVerdict, } = await prepareMemory({
             spec,
             deps,
             sessionId,
             taskRootPath,
             memoryWriteGateRef,
             writeToolsMounted: tools.some((t) => t.name === "Write") && !(toolFaceSnapshot.exclude?.includes("Write") ?? false),
+            memorySearchToolsPlanned,
             admissionCtx: {
                 orgMemoryDenied: complianceDenies.has("org_memory_mount"),
                 complianceDegraded,
@@ -2001,6 +2028,18 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 sharedMemoryPairMounted = true;
             }
         }
+        let memoryEnginePairMounted = false;
+        if (memoryTools !== undefined && memoryTools.length > 0) {
+            tools.push(...memoryTools.map((s) => defineTool(s)));
+            memoryEnginePairMounted = true;
+        }
+        else if (memoryEngineSession !== undefined && !memorySearchToolsPlanned) {
+            deps.onError?.(new Error(`Memory tools ${MEMORY_ENGINE_TOOL_NAMES.join("/")} were NOT mounted: ` +
+                (memoryPairExcludedName !== undefined
+                    ? `excludeTools removes "${memoryPairExcludedName}"`
+                    : `this task already declares a tool named "${memoryPairOccupiedName}" (the built-in yields to it)`) +
+                " — the pair mounts together or not at all."), { phase: "config", sessionId, classification: "memory-tools-not-mounted" });
+        }
         const skillsListing = skillSpecs.length > 0
             ? {
                 entries: skillSpecs.map((s) => ({
@@ -2205,22 +2244,39 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
             return deferredSet;
         };
-        const sharedMemoryPair = SHARED_MEMORY_TOOL_NAMES.filter((n) => tools.some((t) => t.name === n));
+        const sharedMemoryPair = sharedMemoryPairMounted ? SHARED_MEMORY_TOOL_NAMES.filter((n) => tools.some((t) => t.name === n)) : [];
+        const memoryEnginePair = memoryEnginePairMounted ? MEMORY_ENGINE_TOOL_NAMES.filter((n) => tools.some((t) => t.name === n)) : [];
+        const builtinDeferPairNames = [...sharedMemoryPair, ...memoryEnginePair];
         let deferred;
-        if (sharedMemoryPairMounted && sharedMemoryPair.length > 0) {
-            const withoutPair = tools.filter((t) => !sharedMemoryPair.some((n) => n === t.name));
-            const d1 = classifyDeferredOverFace(tools, sharedMemoryPair);
-            const d0 = classifyDeferredOverFace(withoutPair, []);
+        if (builtinDeferPairNames.length > 0) {
+            const withoutPairs = tools.filter((t) => !builtinDeferPairNames.some((n) => n === t.name));
+            const d1 = classifyDeferredOverFace(tools, builtinDeferPairNames);
+            const d0 = classifyDeferredOverFace(withoutPairs, []);
             const soleCause = d0.size === 0 && d1.size > 0;
             const supportNameTaken = tools.some((t) => t.name === TOOL_SEARCH_NAME || (t.aliases ?? []).includes(TOOL_SEARCH_NAME));
             if (soleCause && supportNameTaken) {
                 for (let i = tools.length - 1; i >= 0; i--) {
-                    if (sharedMemoryPair.some((n) => n === tools[i].name))
+                    if (builtinDeferPairNames.some((n) => n === tools[i].name))
                         tools.splice(i, 1);
                 }
-                sharedMemoryPairMounted = false;
-                deps.onError?.(new Error(`Shared memory tools ${SHARED_MEMORY_TOOL_NAMES.join("/")} were NOT mounted: mounting them would inject ` +
-                    `the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares — the pair mounts together or not at all.`), { phase: "config", sessionId, classification: "shared-memory-not-mounted" });
+                if (sharedMemoryPair.length > 0) {
+                    sharedMemoryPairMounted = false;
+                    deps.onError?.(new Error(`Shared memory tools ${SHARED_MEMORY_TOOL_NAMES.join("/")} were NOT mounted: mounting them would inject ` +
+                        `the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares — the pair mounts together or not at all.`), { phase: "config", sessionId, classification: "shared-memory-not-mounted" });
+                }
+                if (memoryEnginePair.length > 0) {
+                    memoryEnginePairMounted = false;
+                    if (memoryBlock !== undefined) {
+                        if (memoryBlock === MEMORY_RECALL_DISCIPLINE)
+                            memoryBlock = undefined;
+                        else if (memoryBlock.includes(`\n\n${MEMORY_RECALL_DISCIPLINE}`))
+                            memoryBlock = memoryBlock.replace(`\n\n${MEMORY_RECALL_DISCIPLINE}`, "");
+                        else if (memoryBlock.startsWith(`${MEMORY_RECALL_DISCIPLINE}\n\n`))
+                            memoryBlock = memoryBlock.slice(MEMORY_RECALL_DISCIPLINE.length + 2);
+                    }
+                    deps.onError?.(new Error(`Memory tools ${MEMORY_ENGINE_TOOL_NAMES.join("/")} were NOT mounted: mounting them would inject ` +
+                        `the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares — the pair mounts together or not at all.`), { phase: "config", sessionId, classification: "memory-tools-not-mounted" });
+                }
                 deferred = d0;
             }
             else {
@@ -2230,6 +2286,78 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         else {
             deferred = classifyDeferredOverFace(tools, []);
         }
+        if (memoryEngineSession !== undefined) {
+            const { pollution, contentSafety } = memoryEngineSession;
+            const callerToolNames = new Set((spec.tools ?? []).map((t) => t.name));
+            const contentOriginWrapped = new WeakSet();
+            const classOf = (t) => classifyToolContentOrigin({
+                declared: t.contentOrigin,
+                isProtocolTool: protocolOf(t.name) !== undefined,
+                isCallerTool: callerToolNames.has(t.name),
+                trusted: contentSafety.trustedTools.has(t.name),
+            });
+            const delegationByName = new Map();
+            for (const t of spec.tools ?? []) {
+                const withFaces = t;
+                if (withFaces.agentToolFaces === undefined && t.agentListing === undefined)
+                    continue;
+                delegationByName.set(t.name, { faces: withFaces.agentToolFaces, pool: withFaces.agentToolPool });
+            }
+            const poolToolPollutes = (t) => contentOriginPollutes(classifyToolContentOrigin({
+                declared: t.contentOrigin,
+                isProtocolTool: protocolOf(t.name) !== undefined,
+                isCallerTool: true,
+                trusted: contentSafety.trustedTools.has(t.name),
+            }), contentSafety.execIsExternalContent);
+            contentOriginWrapRef.current = () => {
+                for (let i = 0; i < tools.length; i++) {
+                    const t = tools[i];
+                    if (contentOriginWrapped.has(t))
+                        continue;
+                    const origin = classOf(t);
+                    const delegation = delegationByName.get(t.name);
+                    const isDelegation = delegation !== undefined;
+                    const pollutes = contentOriginPollutes(origin, contentSafety.execIsExternalContent);
+                    if (!pollutes && !isDelegation) {
+                        contentOriginWrapped.add(t);
+                        continue;
+                    }
+                    const inner = t.execute.bind(t);
+                    const mark = (reason) => {
+                        try {
+                            pollution.markPolluted(reason);
+                        }
+                        catch {
+                        }
+                    };
+                    const wrapped = {
+                        ...t,
+                        execute: async (toolCallId, params, signal, onUpdate) => {
+                            if (pollutes)
+                                mark(`tool "${t.name}" (${origin} content class) was invoked in this session`);
+                            if (!isDelegation)
+                                return inner(toolCallId, params, signal, onUpdate);
+                            const requested = params?.subagent_type;
+                            const external = delegationCallIsExternal({
+                                requestedType: typeof requested === "string" ? requested : undefined,
+                                faces: delegation.faces,
+                                pool: delegation.pool,
+                                isPolluting: poolToolPollutes,
+                            });
+                            const result = await inner(toolCallId, params, signal, onUpdate);
+                            if (external) {
+                                mark(`tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content` +
+                                    (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)"));
+                            }
+                            return result;
+                        },
+                    };
+                    contentOriginWrapped.add(wrapped);
+                    tools[i] = wrapped;
+                }
+            };
+            contentOriginWrapRef.current();
+        }
         let centerAdoption;
         let centerAdoptionFresh = false;
         {
@@ -2358,6 +2486,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             .map((s) => ({ name: inlineUntrusted(s.name, 160), ...(s.error !== undefined ? { error: inlineUntrusted(s.error, 240) } : {}) }));
         let toolsDeltaRef;
         let toolMaterializeStatic = false;
+        let deferDirectCall = false;
         const staticFaceForRef = {};
         if (deferred.size > 0 || failedMcpServers.length > 0) {
             toolsDeltaRef = { pending: [], pendingRemoved: [], pendingReadded: [], pendingFailed: failedMcpServers };
@@ -2380,6 +2509,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const laneDegrade = requestedStrategy === "static" && spec.deferSelfResolve === false;
             const materializeStatic = requestedStrategy === "static" && !laneDegrade;
             toolMaterializeStatic = materializeStatic;
+            deferDirectCall = spec.deferSelfResolve !== false;
             promptManifest.toolDisclosure = {
                 deferredTools: deferred.size,
                 strategy: materializeStatic ? "static" : "swap",
@@ -2472,6 +2602,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const withdrawnTools = new Set();
             const deltaRef = toolsDeltaRef;
             const rematerialize = async (active) => {
+                contentOriginWrapRef.current?.();
                 const list = buildToolList(active);
                 await harnessRef.current.setTools(list, list.map((t) => t.name));
                 if (fpRef.current)
@@ -2515,6 +2646,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         else {
             rebuildHarnessToolsRef.current = async () => {
+                contentOriginWrapRef.current?.();
                 const list = [...tools];
                 await harnessRef.current.setTools(list, list.map((t) => t.name));
                 if (fpRef.current)
@@ -2851,6 +2983,47 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return {};
             return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
         };
+        const permissionRuleLane = (() => {
+            const provider = deps.permissionRuleStore;
+            if (provider === undefined)
+                return undefined;
+            const root = taskRootPath;
+            return {
+                admits: async (req) => {
+                    if (spec.principal === undefined || spec.principal === "")
+                        return undefined;
+                    if (req.toolName !== PERSISTED_RULE_TOOL)
+                        return undefined;
+                    const command = req.args?.command;
+                    if (typeof command !== "string")
+                        return undefined;
+                    let listed;
+                    try {
+                        listed = await provider.forPrincipal(spec.principal).list();
+                    }
+                    catch (err) {
+                        emitTrace(deps.tracer, () => ({
+                            kind: "permission.rule_store_unreadable",
+                            version: 1,
+                            taskId: spec.taskId ?? sessionId,
+                            message: err instanceof Error ? err.message : String(err),
+                            ts: Date.now(),
+                        }));
+                        return undefined;
+                    }
+                    return findAdmittingRule(listed.rules, { tool: req.toolName, command, cwd: root })?.rule;
+                },
+            };
+        })();
+        const ruleSuggestionsOf = (toolName, args) => {
+            if (permissionRuleLane === undefined || toolName !== PERSISTED_RULE_TOOL)
+                return {};
+            const command = args?.command;
+            if (typeof command !== "string")
+                return {};
+            const suggestions = suggestRulesForCommand(command);
+            return suggestions.length > 0 ? { ruleSuggestions: suggestions } : {};
+        };
         const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal) => {
             let editArgs = edit;
             for (let round = 0;; round++) {
@@ -2881,6 +3054,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     toolName: creq.toolName,
                     toolCallId: creq.toolCallId,
                     args: editArgs,
+                    ...ruleSuggestionsOf(creq.toolName, editArgs),
                     message: re.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                     ...askSourceIdentity(),
                     ...riskAxesOf(creq.toolName),
@@ -2929,6 +3103,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         toolName: creq.toolName,
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
+                        ...ruleSuggestionsOf(creq.toolName, presentedArgs),
                         message: first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
                         ...riskAxesOf(creq.toolName),
@@ -2987,6 +3162,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         toolName: creq.toolName,
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
+                        ...ruleSuggestionsOf(creq.toolName, presentedArgs),
                         message: decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
                         ...riskAxesOf(creq.toolName),
@@ -3202,6 +3378,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...(checkpointStore !== undefined ? { checkpointDurability: resolveDeclaredDurability(checkpointStore, "checkpointStore") } : {}),
             sessionDurability: resolveDeclaredDurability(sessions, "sessionStore"),
             backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
+            permissionRuleStoreWired: deps.permissionRuleStore !== undefined,
             hostChildEventSinkWired: deps.onBackgroundChildEvent !== undefined,
             lockedConfigWired: deps.lockedConfig !== undefined,
             complianceWired: deps.compliancePostureResolver !== undefined,
@@ -3290,6 +3467,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const preview = approvalPreviewOf(req.toolName, req.args);
                         return preview !== undefined ? { preview } : {};
                     })(),
+                    ...ruleSuggestionsOf(req.toolName, req.args),
                     message: decision.message ?? `approval required for "${req.toolName}"`,
                     ...askSourceIdentity(),
                     ...riskAxesOf(req.toolName),
@@ -3403,15 +3581,16 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             });
             const commitSuspendSaga = async (token, cp, remoteEnv, remoteHandle) => {
                 if (!checkpointStore)
-                    return false;
+                    return { ok: false };
                 if (memoryEngineSession)
                     await memoryEngineSession.harvest("checkpoint");
                 try {
                     await checkpointStore.put(token, cp);
-                    return true;
+                    return { ok: true };
                 }
                 catch (putErr) {
                     deps.onError?.(putErr, { phase: "config", sessionId });
+                    const reason = "the approval checkpoint could not be persisted (the store rejected the write; the deployment's error face carries the store's own message)";
                     if (remoteEnv !== undefined && remoteHandle?.snapshotId !== undefined) {
                         const { outcome: back, attempts: backAttempts } = await restoreWorkspaceWithRetry(remoteEnv, remoteHandle.snapshotId, {
                             abortSignal: abortController.signal,
@@ -3419,7 +3598,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         if (back.ok) {
                             const init = await remoteEnv.postResumeInit();
                             if (init.ok)
-                                return false;
+                                return { ok: false, reason };
                             remoteEnvFailures.push(remoteEnvFailureNote("postResumeInit", init.error, 1));
                             deps.onError?.(init.error, { phase: "config", sessionId });
                         }
@@ -3429,9 +3608,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         abortController.abort();
                         void harness.abort();
-                        return false;
+                        return { ok: false, reason };
                     }
-                    return false;
+                    return { ok: false, reason };
                 }
             };
             const publishCommittedSuspend = (token, gate, scope, remoteHandle) => {
@@ -3519,7 +3698,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     resourceLedger: resourceLedgerOut,
                     ...(spec.durableApproval !== undefined ? { durableApproval: { ...spec.durableApproval } } : {}),
                 };
-                if (!(await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)))
+                if (!(await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).ok)
                     return false;
                 publishCommittedSuspend(token, gate, scope, remoteHandle);
                 try {
@@ -3604,7 +3783,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         ...(spec.principal ? { principal: spec.principal } : {}),
                         ...(spec.durableApproval !== undefined ? { durableApproval: { ...spec.durableApproval } } : {}),
                     };
-                    if (!(await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)))
+                    if (!(await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).ok)
                         return false;
                     publishCommittedSuspend(token, gate, scope, remoteHandle);
                     try {
@@ -3700,7 +3879,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             };
             const suspendAsk = parkLaneArmed && checkpointStore !== undefined
                 ? async (req, postHookArgs, safety, liveFaceUnavailable) => {
-                    const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : typeof onAsk === "function";
+                    const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
                     if (syncFirstEligible &&
                         runtimeCaps?.forceDurableGate !== true &&
                         liveFaceUnavailable !== true &&
@@ -3713,13 +3892,50 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     let remoteHandle;
                     const remoteEnv = suspendableEnv;
                     try {
+                        const parked = tryCloneArgs(postHookArgs);
+                        if (!parked.ok) {
+                            throw new ParkRefusal(`the arguments of "${req.toolName}" cannot be captured onto an approval checkpoint (unclonable value: ${parked.reason}) — ` +
+                                `a durable approval row must hold an inert snapshot of exactly what a human approves and a resume executes`, { cause: parked.cause });
+                        }
+                        let backendFidelity;
+                        try {
+                            backendFidelity = resolveDeclaredFidelity(checkpointStore, "checkpointStore");
+                        }
+                        catch (err) {
+                            throw new ParkRefusal(`the checkpoint backend declares an unrecognized encoding fidelity, so the width of the snapshot this row may hold is unknown (${describeThrown(err)}) — ` +
+                                `refusing to park rather than guess which values would survive it`, { cause: err });
+                        }
+                        const captured = encodeAtFidelity(backendFidelity, parked.value);
+                        if (!captured.ok) {
+                            throw new ParkRefusal(`the arguments of "${req.toolName}" cannot be encoded by this checkpoint backend (${describeThrown(captured.cause)}) — ` +
+                                `a durable approval row must hold an inert snapshot of exactly what a human approves and a resume executes`, { cause: captured.cause });
+                        }
+                        const parkedArgs = captured.value;
+                        const projectionMovedArgs = backendFidelity !== "structured-clone" && !samePlainValue(parked.value, parkedArgs);
+                        if (projectionMovedArgs && basePolicyForResumeEdit !== undefined) {
+                            const presented = encodeAtFidelity(backendFidelity, parkedArgs);
+                            if (!presented.ok) {
+                                throw new ParkRefusal(`the stored form of "${req.toolName}"'s arguments could not be presented for re-adjudication (${describeThrown(presented.cause)})`, { cause: presented.cause });
+                            }
+                            const reprojected = refuseOutOfContractDecision(await basePolicyForResumeEdit.check({ toolName: req.toolName, args: presented.value, toolCallId: req.toolCallId }, abortController.signal));
+                            const demanded = reprojected.updatedInput !== undefined ? tryCloneArgs(reprojected.updatedInput) : undefined;
+                            const rewroteTheFiledValue = reprojected.updatedInput !== undefined &&
+                                !(demanded?.ok === true &&
+                                    samePlainValue(demanded.value, parkedArgs) &&
+                                    samePlainValue(reprojected.updatedInput, parkedArgs));
+                            if (reprojected.action === "deny" || rewroteTheFiledValue) {
+                                throw new ParkRefusal(`the arguments of "${req.toolName}" change shape when stored by this checkpoint backend, and the deployment's tool policy does not accept the stored shape` +
+                                    `${reprojected.action === "deny" && reprojected.message ? `: ${reprojected.message}` : ""} — ` +
+                                    `refusing to file a row whose executable form nothing adjudicated`);
+                            }
+                        }
                         if (offloadStore && isVolatileOffloadStore(offloadStore) && !offloadStore.isEmpty()) {
-                            throw new Error("durable suspend requires a durable toolResultStore (the default InMemoryToolResultStore " +
+                            throw new ParkRefusal("durable suspend requires a durable toolResultStore (the default InMemoryToolResultStore " +
                                 "holds offloaded results that are lost across a cross-replica resume); inject " +
                                 "RunnerDeps.toolResultStore or disable offload.");
                         }
                         if (ownedEnv !== undefined && remoteEnv === undefined && parkOnlyRemoteEnv === undefined) {
-                            throw new Error(incompleteSuspendAdapter !== undefined
+                            throw new ParkRefusal(incompleteSuspendAdapter !== undefined
                                 ? `durable suspend is not supported with this per-task executionEnvFactory env: it declares capabilities.suspendable but its adapter does not implement ${incompleteSuspendAdapter.join(" or ")}, so a snapshot taken now could never be restored. Implement the full RemoteExecutionEnv restore surface, or declare capabilities.suspendable:false if the workspace is externally durable (the park-only lane).`
                                 : "durable suspend is not supported with a non-remote per-task executionEnvFactory env: the " +
                                     "minted env is destroyed on suspend, so a resumed file/shell tool would act on a fresh " +
@@ -3728,7 +3944,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         const leafId = await session.getLeafId();
                         if (!leafId) {
-                            throw new Error("cannot suspend: session has no committed leaf to resume from");
+                            throw new ParkRefusal("cannot suspend: session has no committed leaf to resume from");
                         }
                         const { messages } = await session.buildContext();
                         const { batchToolCallIds, completedCallIds } = batchContextAt(messages, req.toolCallId);
@@ -3755,7 +3971,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         token = mintCheckpointToken();
                         const riskDescriptor = buildRiskDescriptor({
                             toolName: req.toolName,
-                            args: postHookArgs,
+                            args: parkedArgs,
                             safety,
                             shellGated: (req.toolName === "Bash" && shellGatedBash) || (req.toolName === "Monitor" && shellGatedMonitor),
                             ...(effectiveShellGate !== "off" ? { shellGateDoctrine: effectiveShellGate } : {}),
@@ -3798,12 +4014,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                 kind: "tool_approval",
                                 toolCallId: req.toolCallId,
                                 toolName: req.toolName,
-                                args: postHookArgs,
+                                args: parkedArgs,
                                 ...(() => {
-                                    const preview = approvalPreviewOf(req.toolName, postHookArgs);
+                                    const preview = approvalPreviewOf(req.toolName, parkedArgs);
                                     return preview !== undefined ? { preview } : {};
                                 })(),
-                                boundInputHash: boundInputHashOf(postHookArgs),
+                                ...ruleSuggestionsOf(req.toolName, parkedArgs),
+                                boundInputHash: boundInputHashOf(parkedArgs),
                                 batchToolCallIds,
                                 completedCallIds,
                             },
@@ -3828,10 +4045,15 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                     catch (err) {
                         deps.onError?.(err, { phase: "config", sessionId });
-                        return undefined;
+                        return {
+                            parkFailed: err instanceof ParkRefusal
+                                ? err.message
+                                : "the durable approval park could not be prepared (the deployment's error face carries the exception)",
+                        };
                     }
-                    if (!(await commitSuspendSaga(token, cp, remoteEnv, remoteHandle))) {
-                        return undefined;
+                    const committed = await commitSuspendSaga(token, cp, remoteEnv, remoteHandle);
+                    if (!committed.ok) {
+                        return committed.reason !== undefined ? { parkFailed: committed.reason } : undefined;
                     }
                     publishCommittedSuspend(token, gate, cp.scope, remoteHandle);
                     try {
@@ -3905,6 +4127,22 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             onHookError: notifyHookError,
                             shellGated: (e.toolName === "Bash" && shellGatedBash) || (e.toolName === "Monitor" && shellGatedMonitor),
                             ...(autoModeDecider ? { autoMode: { decider: autoModeDecider } } : {}),
+                            ...(permissionRuleLane
+                                ? {
+                                    persistedRules: {
+                                        admits: permissionRuleLane.admits,
+                                        onResolved: (info) => emitTrace(deps.tracer, () => ({
+                                            kind: "permission.persisted_rule_allowed",
+                                            version: 1,
+                                            taskId: spec.taskId ?? sessionId,
+                                            toolName: info.toolName,
+                                            toolCallId: info.toolCallId,
+                                            rule: info.rule,
+                                            ts: Date.now(),
+                                        })),
+                                    },
+                                }
+                                : {}),
                             isMarkedUnresolvable: (toolCallId) => inheritedUnavailableAsks.has(toolCallId),
                         });
                     }
@@ -4206,7 +4444,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             : undefined;
         overheadState.promptChars = systemPrompt.length;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.js

@@ -328,6 +328,24 @@ function platformLimitTerminal(reason, retryAfterMs, moment = "turn_boundary") {
         e.retryAfterMs = retryAfterMs;
     return e;
 }
+const disclosedUnevaluableWindow = new WeakSet();
+function discloseUnevaluableWindow(u, prepared, tracer, taskId, onError) {
+    if (disclosedUnevaluableWindow.has(prepared))
+        return;
+    disclosedUnevaluableWindow.add(prepared);
+    emitTrace(tracer, () => ({ kind: "compaction.unevaluable", version: 1, taskId, estTokens: u.estTokens, ts: Date.now() }));
+    const modelClause = u.modelId !== undefined ? ` "${u.modelId}"` : "";
+    const cause = u.windowValue !== undefined
+        ? `its \`${u.windowField}\` is ${u.windowValue}, which is not a positive number of tokens — that field takes precedence over the ` +
+            `others, so fixing or removing it is what restores the threshold`
+        : `it declares no context window at all (\`autoCompactTokens\` / \`contextTokens\` / \`contextWindow\` are all absent) — declare one to restore the threshold`;
+    try {
+        onError?.(new Error(`auto-compaction cannot run for model${modelClause}: ${cause}. Until then there is no threshold to compare against, so the ` +
+            `context will grow until the provider refuses the request. The conversation is already about ${u.estTokens} estimated tokens.`), { phase: "config", sessionId: prepared.sessionId });
+    }
+    catch {
+    }
+}
 function makeTurnBoundary(prepared, stats, rs, deps) {
     const { spec, queue, manualCompactRef, todoToolMounted, taskToolsMounted, walltimeMonotonicDeadline, timeout, ident, postToolBatchHook, batchArgs, compactionBrain, withinTaskCompaction, compactionBreaker, windowSafetyOptions, rapidRefill, drainManualCompact, runnerHooks } = deps;
     let finalVerifySeenAtLastBoundary = 0;
@@ -577,7 +595,9 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                         skillsListing: rs.attach.skillsListingOn,
                         mcpInstructions: mcpInstructionsOn,
                     },
-                    ...(undiscoveredTools !== undefined && undiscoveredTools.length > 0 ? { undiscoveredTools } : {}),
+                    ...(undiscoveredTools !== undefined && undiscoveredTools.length > 0
+                        ? { undiscoveredTools, deferDirectCall: prepared.deferDirectCall }
+                        : {}),
                     ...(changed !== undefined ? { changedFiles: changed } : {}),
                     ...(budgetUsdOn && rs.budget.maxCostMicroUsd !== undefined
                         ? { budgetUsd: { used: stats.costMicroUsd / 1e6, total: rs.budget.maxCostMicroUsd / 1e6 } }
@@ -851,6 +871,9 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             if (comp.contextUsage) {
                 queue.push({ type: "context_usage", ...comp.contextUsage, ...ident() });
             }
+            if (comp.unevaluableWindow) {
+                discloseUnevaluableWindow(comp.unevaluableWindow, prepared, rs.telemetry.tracer, rs.telemetry.taskId, runnerHooks.onError);
+            }
             if (comp.suppressedByFloor) {
                 const s = comp.suppressedByFloor;
                 emitTrace(rs.telemetry.tracer, () => ({
@@ -3967,6 +3990,9 @@ export class Runner {
                     ...this.compactionHookOptions(spec, prepared.sessionId, "auto"),
                 });
                 this.recordCompactionReuse(prepared, finishComp);
+                if (finishComp.unevaluableWindow) {
+                    discloseUnevaluableWindow(finishComp.unevaluableWindow, prepared, spec.tracer ?? this.deps.tracer, spec.taskId ?? prepared.sessionId, this.deps.onError);
+                }
                 comp = finishComp;
             }
             catch (err) {