@sema-agent/core 5.17.0 → 5.18.1

package/dist/core/runner/prepare-task.js

@@ -20,7 +20,9 @@ import { createSubagentWorktreeHelper, forkGovernanceDenial } from "../../agents
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import { askApproverIdentity, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
+import { askApproverIdentity, combinePolicies, isApprovalSettledBy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
+const PERSISTED_RULE_TOOL = "Bash";
+import { findAdmittingRule, suggestRulesForCommand } from "../permission-rule-model.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
 import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentListingDelta } from "./turn-attachments.js";
 import { inlineUntrusted } from "../untrusted-text.js";
@@ -41,6 +43,9 @@ import { compileOutputSchema } from "./strict-output-schema.js";
 import { TOOL_SEARCH_NAME, buildDeferredRegistry, classifyDeferred, extractDiscoveredToolNames, createPlaceholderTool, createToolSearchTool, staticSchemaRenderable, } from "./tool-disclosure.js";
 import { createSharedMemoryTools } from "../shared-memory/tools.js";
 import { SHARED_MEMORY_TOOL_NAMES } from "../shared-memory/types.js";
+import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
+import { MEMORY_RECALL_DISCIPLINE } from "../memory-engine/engine.js";
+import { classifyToolContentOrigin, contentOriginPollutes, delegationCallIsExternal } from "../memory-engine/content-origin.js";
 import { composeMemoryBlock } from "../memory.js";
 import { preflightLockedConfig } from "../locked-config.js";
 import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, complianceCallDenial, resolveComplianceDenies } from "../compliance.js";
@@ -1389,6 +1394,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         tools.push(...mcp.tools.map((t) => remoteToolOffload(t)));
         const rebuildHarnessToolsRef = {};
+        const contentOriginWrapRef = {};
         const toolCallGateArmedRef = { armed: false };
         if (lockedPreflight.mcp?.length) {
             tools.push({
@@ -1868,13 +1874,23 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     .catch(() => undefined);
             }
             : undefined;
-        const { memoryEngineSession, memoryBlock: memoryBlockFromEngine, seedFiles: memorySeedFiles, admittedOrgScopes: memoryAdmittedOrgScopes, ownOrgVerdict: memoryOwnOrgVerdict, } = await prepareMemory({
+        const memoryPairNameDomain = new Set();
+        for (const t of tools) {
+            memoryPairNameDomain.add(t.name);
+            for (const alias of t.aliases ?? [])
+                memoryPairNameDomain.add(alias);
+        }
+        const memoryPairExcludedName = MEMORY_ENGINE_TOOL_NAMES.find((n) => (toolFaceSnapshot.exclude ?? []).includes(n));
+        const memoryPairOccupiedName = MEMORY_ENGINE_TOOL_NAMES.find((n) => memoryPairNameDomain.has(n));
+        const memorySearchToolsPlanned = memoryPairExcludedName === undefined && memoryPairOccupiedName === undefined;
+        const { memoryEngineSession, memoryBlock: memoryBlockFromEngine, memoryTools, seedFiles: memorySeedFiles, admittedOrgScopes: memoryAdmittedOrgScopes, ownOrgVerdict: memoryOwnOrgVerdict, } = await prepareMemory({
             spec,
             deps,
             sessionId,
             taskRootPath,
             memoryWriteGateRef,
             writeToolsMounted: tools.some((t) => t.name === "Write") && !(toolFaceSnapshot.exclude?.includes("Write") ?? false),
+            memorySearchToolsPlanned,
             admissionCtx: {
                 orgMemoryDenied: complianceDenies.has("org_memory_mount"),
                 complianceDegraded,
@@ -2012,6 +2028,18 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 sharedMemoryPairMounted = true;
             }
         }
+        let memoryEnginePairMounted = false;
+        if (memoryTools !== undefined && memoryTools.length > 0) {
+            tools.push(...memoryTools.map((s) => defineTool(s)));
+            memoryEnginePairMounted = true;
+        }
+        else if (memoryEngineSession !== undefined && !memorySearchToolsPlanned) {
+            deps.onError?.(new Error(`Memory tools ${MEMORY_ENGINE_TOOL_NAMES.join("/")} were NOT mounted: ` +
+                (memoryPairExcludedName !== undefined
+                    ? `excludeTools removes "${memoryPairExcludedName}"`
+                    : `this task already declares a tool named "${memoryPairOccupiedName}" (the built-in yields to it)`) +
+                " — the pair mounts together or not at all."), { phase: "config", sessionId, classification: "memory-tools-not-mounted" });
+        }
         const skillsListing = skillSpecs.length > 0
             ? {
                 entries: skillSpecs.map((s) => ({
@@ -2216,22 +2244,39 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
             return deferredSet;
         };
-        const sharedMemoryPair = SHARED_MEMORY_TOOL_NAMES.filter((n) => tools.some((t) => t.name === n));
+        const sharedMemoryPair = sharedMemoryPairMounted ? SHARED_MEMORY_TOOL_NAMES.filter((n) => tools.some((t) => t.name === n)) : [];
+        const memoryEnginePair = memoryEnginePairMounted ? MEMORY_ENGINE_TOOL_NAMES.filter((n) => tools.some((t) => t.name === n)) : [];
+        const builtinDeferPairNames = [...sharedMemoryPair, ...memoryEnginePair];
         let deferred;
-        if (sharedMemoryPairMounted && sharedMemoryPair.length > 0) {
-            const withoutPair = tools.filter((t) => !sharedMemoryPair.some((n) => n === t.name));
-            const d1 = classifyDeferredOverFace(tools, sharedMemoryPair);
-            const d0 = classifyDeferredOverFace(withoutPair, []);
+        if (builtinDeferPairNames.length > 0) {
+            const withoutPairs = tools.filter((t) => !builtinDeferPairNames.some((n) => n === t.name));
+            const d1 = classifyDeferredOverFace(tools, builtinDeferPairNames);
+            const d0 = classifyDeferredOverFace(withoutPairs, []);
             const soleCause = d0.size === 0 && d1.size > 0;
             const supportNameTaken = tools.some((t) => t.name === TOOL_SEARCH_NAME || (t.aliases ?? []).includes(TOOL_SEARCH_NAME));
             if (soleCause && supportNameTaken) {
                 for (let i = tools.length - 1; i >= 0; i--) {
-                    if (sharedMemoryPair.some((n) => n === tools[i].name))
+                    if (builtinDeferPairNames.some((n) => n === tools[i].name))
                         tools.splice(i, 1);
                 }
-                sharedMemoryPairMounted = false;
-                deps.onError?.(new Error(`Shared memory tools ${SHARED_MEMORY_TOOL_NAMES.join("/")} were NOT mounted: mounting them would inject ` +
-                    `the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares — the pair mounts together or not at all.`), { phase: "config", sessionId, classification: "shared-memory-not-mounted" });
+                if (sharedMemoryPair.length > 0) {
+                    sharedMemoryPairMounted = false;
+                    deps.onError?.(new Error(`Shared memory tools ${SHARED_MEMORY_TOOL_NAMES.join("/")} were NOT mounted: mounting them would inject ` +
+                        `the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares — the pair mounts together or not at all.`), { phase: "config", sessionId, classification: "shared-memory-not-mounted" });
+                }
+                if (memoryEnginePair.length > 0) {
+                    memoryEnginePairMounted = false;
+                    if (memoryBlock !== undefined) {
+                        if (memoryBlock === MEMORY_RECALL_DISCIPLINE)
+                            memoryBlock = undefined;
+                        else if (memoryBlock.includes(`\n\n${MEMORY_RECALL_DISCIPLINE}`))
+                            memoryBlock = memoryBlock.replace(`\n\n${MEMORY_RECALL_DISCIPLINE}`, "");
+                        else if (memoryBlock.startsWith(`${MEMORY_RECALL_DISCIPLINE}\n\n`))
+                            memoryBlock = memoryBlock.slice(MEMORY_RECALL_DISCIPLINE.length + 2);
+                    }
+                    deps.onError?.(new Error(`Memory tools ${MEMORY_ENGINE_TOOL_NAMES.join("/")} were NOT mounted: mounting them would inject ` +
+                        `the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares — the pair mounts together or not at all.`), { phase: "config", sessionId, classification: "memory-tools-not-mounted" });
+                }
                 deferred = d0;
             }
             else {
@@ -2241,6 +2286,78 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         else {
             deferred = classifyDeferredOverFace(tools, []);
         }
+        if (memoryEngineSession !== undefined) {
+            const { pollution, contentSafety } = memoryEngineSession;
+            const callerToolNames = new Set((spec.tools ?? []).map((t) => t.name));
+            const contentOriginWrapped = new WeakSet();
+            const classOf = (t) => classifyToolContentOrigin({
+                declared: t.contentOrigin,
+                isProtocolTool: protocolOf(t.name) !== undefined,
+                isCallerTool: callerToolNames.has(t.name),
+                trusted: contentSafety.trustedTools.has(t.name),
+            });
+            const delegationByName = new Map();
+            for (const t of spec.tools ?? []) {
+                const withFaces = t;
+                if (withFaces.agentToolFaces === undefined && t.agentListing === undefined)
+                    continue;
+                delegationByName.set(t.name, { faces: withFaces.agentToolFaces, pool: withFaces.agentToolPool });
+            }
+            const poolToolPollutes = (t) => contentOriginPollutes(classifyToolContentOrigin({
+                declared: t.contentOrigin,
+                isProtocolTool: protocolOf(t.name) !== undefined,
+                isCallerTool: true,
+                trusted: contentSafety.trustedTools.has(t.name),
+            }), contentSafety.execIsExternalContent);
+            contentOriginWrapRef.current = () => {
+                for (let i = 0; i < tools.length; i++) {
+                    const t = tools[i];
+                    if (contentOriginWrapped.has(t))
+                        continue;
+                    const origin = classOf(t);
+                    const delegation = delegationByName.get(t.name);
+                    const isDelegation = delegation !== undefined;
+                    const pollutes = contentOriginPollutes(origin, contentSafety.execIsExternalContent);
+                    if (!pollutes && !isDelegation) {
+                        contentOriginWrapped.add(t);
+                        continue;
+                    }
+                    const inner = t.execute.bind(t);
+                    const mark = (reason) => {
+                        try {
+                            pollution.markPolluted(reason);
+                        }
+                        catch {
+                        }
+                    };
+                    const wrapped = {
+                        ...t,
+                        execute: async (toolCallId, params, signal, onUpdate) => {
+                            if (pollutes)
+                                mark(`tool "${t.name}" (${origin} content class) was invoked in this session`);
+                            if (!isDelegation)
+                                return inner(toolCallId, params, signal, onUpdate);
+                            const requested = params?.subagent_type;
+                            const external = delegationCallIsExternal({
+                                requestedType: typeof requested === "string" ? requested : undefined,
+                                faces: delegation.faces,
+                                pool: delegation.pool,
+                                isPolluting: poolToolPollutes,
+                            });
+                            const result = await inner(toolCallId, params, signal, onUpdate);
+                            if (external) {
+                                mark(`tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content` +
+                                    (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)"));
+                            }
+                            return result;
+                        },
+                    };
+                    contentOriginWrapped.add(wrapped);
+                    tools[i] = wrapped;
+                }
+            };
+            contentOriginWrapRef.current();
+        }
         let centerAdoption;
         let centerAdoptionFresh = false;
         {
@@ -2485,6 +2602,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const withdrawnTools = new Set();
             const deltaRef = toolsDeltaRef;
             const rematerialize = async (active) => {
+                contentOriginWrapRef.current?.();
                 const list = buildToolList(active);
                 await harnessRef.current.setTools(list, list.map((t) => t.name));
                 if (fpRef.current)
@@ -2528,6 +2646,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         else {
             rebuildHarnessToolsRef.current = async () => {
+                contentOriginWrapRef.current?.();
                 const list = [...tools];
                 await harnessRef.current.setTools(list, list.map((t) => t.name));
                 if (fpRef.current)
@@ -2864,6 +2983,47 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return {};
             return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
         };
+        const permissionRuleLane = (() => {
+            const provider = deps.permissionRuleStore;
+            if (provider === undefined)
+                return undefined;
+            const root = taskRootPath;
+            return {
+                admits: async (req) => {
+                    if (spec.principal === undefined || spec.principal === "")
+                        return undefined;
+                    if (req.toolName !== PERSISTED_RULE_TOOL)
+                        return undefined;
+                    const command = req.args?.command;
+                    if (typeof command !== "string")
+                        return undefined;
+                    let listed;
+                    try {
+                        listed = await provider.forPrincipal(spec.principal).list();
+                    }
+                    catch (err) {
+                        emitTrace(deps.tracer, () => ({
+                            kind: "permission.rule_store_unreadable",
+                            version: 1,
+                            taskId: spec.taskId ?? sessionId,
+                            message: err instanceof Error ? err.message : String(err),
+                            ts: Date.now(),
+                        }));
+                        return undefined;
+                    }
+                    return findAdmittingRule(listed.rules, { tool: req.toolName, command, cwd: root })?.rule;
+                },
+            };
+        })();
+        const ruleSuggestionsOf = (toolName, args) => {
+            if (permissionRuleLane === undefined || toolName !== PERSISTED_RULE_TOOL)
+                return {};
+            const command = args?.command;
+            if (typeof command !== "string")
+                return {};
+            const suggestions = suggestRulesForCommand(command);
+            return suggestions.length > 0 ? { ruleSuggestions: suggestions } : {};
+        };
         const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal) => {
             let editArgs = edit;
             for (let round = 0;; round++) {
@@ -2894,6 +3054,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     toolName: creq.toolName,
                     toolCallId: creq.toolCallId,
                     args: editArgs,
+                    ...ruleSuggestionsOf(creq.toolName, editArgs),
                     message: re.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                     ...askSourceIdentity(),
                     ...riskAxesOf(creq.toolName),
@@ -2942,6 +3103,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         toolName: creq.toolName,
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
+                        ...ruleSuggestionsOf(creq.toolName, presentedArgs),
                         message: first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
                         ...riskAxesOf(creq.toolName),
@@ -3000,6 +3162,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         toolName: creq.toolName,
                         toolCallId: creq.toolCallId,
                         args: presentedArgs,
+                        ...ruleSuggestionsOf(creq.toolName, presentedArgs),
                         message: decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                         ...askSourceIdentity(),
                         ...riskAxesOf(creq.toolName),
@@ -3141,6 +3304,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         const preToolContexts = new Map();
         const blockedToolCalls = new Set();
+        const approvalSettledBy = new Map();
         const blockedTracked = Boolean(hooks?.postToolUse || hooks?.preToolUse || hooks?.postToolUseFailure || hooks?.postToolBatch);
         const restoreSurfaceGap = ownedEnv !== undefined && isRemoteExecutionEnv(ownedEnv) && ownedEnv.capabilities.suspendable ? missingRestoreSurface(ownedEnv) : [];
         const incompleteSuspendAdapter = restoreSurfaceGap.length > 0 ? restoreSurfaceGap : undefined;
@@ -3215,6 +3379,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...(checkpointStore !== undefined ? { checkpointDurability: resolveDeclaredDurability(checkpointStore, "checkpointStore") } : {}),
             sessionDurability: resolveDeclaredDurability(sessions, "sessionStore"),
             backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
+            permissionRuleStoreWired: deps.permissionRuleStore !== undefined,
             hostChildEventSinkWired: deps.onBackgroundChildEvent !== undefined,
             lockedConfigWired: deps.lockedConfig !== undefined,
             complianceWired: deps.compliancePostureResolver !== undefined,
@@ -3303,6 +3468,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const preview = approvalPreviewOf(req.toolName, req.args);
                         return preview !== undefined ? { preview } : {};
                     })(),
+                    ...ruleSuggestionsOf(req.toolName, req.args),
                     message: decision.message ?? `approval required for "${req.toolName}"`,
                     ...askSourceIdentity(),
                     ...riskAxesOf(req.toolName),
@@ -3854,6 +4020,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                     const preview = approvalPreviewOf(req.toolName, parkedArgs);
                                     return preview !== undefined ? { preview } : {};
                                 })(),
+                                ...ruleSuggestionsOf(req.toolName, parkedArgs),
                                 boundInputHash: boundInputHashOf(parkedArgs),
                                 batchToolCallIds,
                                 completedCallIds,
@@ -3961,6 +4128,22 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             onHookError: notifyHookError,
                             shellGated: (e.toolName === "Bash" && shellGatedBash) || (e.toolName === "Monitor" && shellGatedMonitor),
                             ...(autoModeDecider ? { autoMode: { decider: autoModeDecider } } : {}),
+                            ...(permissionRuleLane
+                                ? {
+                                    persistedRules: {
+                                        admits: permissionRuleLane.admits,
+                                        onResolved: (info) => emitTrace(deps.tracer, () => ({
+                                            kind: "permission.persisted_rule_allowed",
+                                            version: 1,
+                                            taskId: spec.taskId ?? sessionId,
+                                            toolName: info.toolName,
+                                            toolCallId: info.toolCallId,
+                                            rule: info.rule,
+                                            ts: Date.now(),
+                                        })),
+                                    },
+                                }
+                                : {}),
                             isMarkedUnresolvable: (toolCallId) => inheritedUnavailableAsks.has(toolCallId),
                         });
                     }
@@ -3974,6 +4157,17 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     if (blockedTracked && (result.block || result.suspend)) {
                         blockedToolCalls.add(e.toolCallId);
                     }
+                    const reported = result.settledBy;
+                    if (reported !== undefined) {
+                        const settling = result.block === true;
+                        if (!isApprovalSettledBy(reported) || (!settling && reported !== "human")) {
+                            deps.onError?.(new Error(`a tool-gate settlement reported settledBy "${String(reported)}" on ${settling ? "a blocked" : "an executing"} call — ` +
+                                `it is one of "human" / "timeout" / "aborted", and only "human" can be the source of a call that runs; the frame carries no source`), { phase: "config", sessionId });
+                        }
+                        else {
+                            approvalSettledBy.set(e.toolCallId, reported);
+                        }
+                    }
                     return result.block
                         ? { block: true, reason: result.reason }
                         : result.updatedInput !== undefined
@@ -4262,7 +4456,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             : undefined;
         overheadState.promptChars = systemPrompt.length;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettledBy, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.d.ts

@@ -5,6 +5,7 @@ import { type TaskOutcome } from "../task-outcome.js";
 import { type SideQuerySpec, type SideQueryResult } from "../side-query.js";
 import type { SessionStore } from "../session.js";
 import { type RecoveredOrphan } from "../session-reconcile.js";
+import { type ApprovalSettledBy } from "../tool-policy.js";
 import type { AgentDefinition, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream } from "../types.js";
 export type ResumeTaskConfig = Omit<TaskSpec, "objective" | "sessionId">;
 interface ResumeRun {
@@ -17,12 +18,13 @@ interface ResumeRun {
     onEnvRestoreFailed?: (reason: ReopenReason) => Promise<void>;
     decisionDelivered?: boolean;
 }
-declare function toolEndBodyFrom(result: unknown, isError: boolean): {
+declare function toolEndBodyFrom(result: unknown, isError: boolean, settledBy?: ApprovalSettledBy): {
     output?: unknown;
     truncated?: boolean;
     totalChars?: number;
     structured?: unknown;
     errorCode?: string;
+    settledBy?: ApprovalSettledBy;
 };
 export declare function reconciledToolEndBody(orphan: Pick<RecoveredOrphan, "text" | "errorKind">): ReturnType<typeof toolEndBodyFrom>;
 export declare const GOVERNANCE_READ_STALLED: unique symbol;

package/dist/core/runner/runtask.js

@@ -38,7 +38,7 @@ import { delimitUntrusted, inlineUntrusted, sanitizeUntrustedText } from "../unt
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
-import { refuseOutOfContractDecision, toolPolicyNameSets } from "../tool-policy.js";
+import { isApprovalSettledBy, refuseOutOfContractDecision, toolPolicyNameSets } from "../tool-policy.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { discloseDroppedPending, isDelegatedAgentTerminal, PendingSessionNotifications, renderTaskNotificationXml, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
 import { ToolDetachHub } from "../tool-detach.js";
@@ -126,7 +126,7 @@ function resumeDecisionWasNegative(resume) {
 }
 const DEFERRED_REISSUE = "[DEFERRED] This tool call shared a batch with a call that suspended for durable approval, so it was " +
     "NOT executed on resume. If you still need it, issue it again now.";
-function toolEndBodyFrom(result, isError) {
+function toolEndBodyFrom(result, isError, settledBy) {
     const o = toolOutputFrom(result);
     const st = structuredFrom(result);
     const code = isError ? result?.details?.code : undefined;
@@ -134,6 +134,7 @@ function toolEndBodyFrom(result, isError) {
         ...(o !== undefined ? { output: o.output, ...(o.truncated ? { truncated: true } : {}), ...(o.totalChars !== undefined ? { totalChars: o.totalChars } : {}) } : {}),
         ...(st !== undefined ? { structured: st } : {}),
         ...(typeof code === "string" ? { errorCode: code } : {}),
+        ...(settledBy !== undefined ? { settledBy } : {}),
     };
 }
 export function reconciledToolEndBody(orphan) {
@@ -328,6 +329,24 @@ function platformLimitTerminal(reason, retryAfterMs, moment = "turn_boundary") {
         e.retryAfterMs = retryAfterMs;
     return e;
 }
+const disclosedUnevaluableWindow = new WeakSet();
+function discloseUnevaluableWindow(u, prepared, tracer, taskId, onError) {
+    if (disclosedUnevaluableWindow.has(prepared))
+        return;
+    disclosedUnevaluableWindow.add(prepared);
+    emitTrace(tracer, () => ({ kind: "compaction.unevaluable", version: 1, taskId, estTokens: u.estTokens, ts: Date.now() }));
+    const modelClause = u.modelId !== undefined ? ` "${u.modelId}"` : "";
+    const cause = u.windowValue !== undefined
+        ? `its \`${u.windowField}\` is ${u.windowValue}, which is not a positive number of tokens — that field takes precedence over the ` +
+            `others, so fixing or removing it is what restores the threshold`
+        : `it declares no context window at all (\`autoCompactTokens\` / \`contextTokens\` / \`contextWindow\` are all absent) — declare one to restore the threshold`;
+    try {
+        onError?.(new Error(`auto-compaction cannot run for model${modelClause}: ${cause}. Until then there is no threshold to compare against, so the ` +
+            `context will grow until the provider refuses the request. The conversation is already about ${u.estTokens} estimated tokens.`), { phase: "config", sessionId: prepared.sessionId });
+    }
+    catch {
+    }
+}
 function makeTurnBoundary(prepared, stats, rs, deps) {
     const { spec, queue, manualCompactRef, todoToolMounted, taskToolsMounted, walltimeMonotonicDeadline, timeout, ident, postToolBatchHook, batchArgs, compactionBrain, withinTaskCompaction, compactionBreaker, windowSafetyOptions, rapidRefill, drainManualCompact, runnerHooks } = deps;
     let finalVerifySeenAtLastBoundary = 0;
@@ -853,6 +872,9 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
             if (comp.contextUsage) {
                 queue.push({ type: "context_usage", ...comp.contextUsage, ...ident() });
             }
+            if (comp.unevaluableWindow) {
+                discloseUnevaluableWindow(comp.unevaluableWindow, prepared, rs.telemetry.tracer, rs.telemetry.taskId, runnerHooks.onError);
+            }
             if (comp.suppressedByFloor) {
                 const s = comp.suppressedByFloor;
                 emitTrace(rs.telemetry.tracer, () => ({
@@ -1181,13 +1203,16 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
                     prepared.lspDiagnostics.nudge(p);
             }
         }
+        const settledBy = prepared.approvalSettledBy.get(event.toolCallId);
+        if (settledBy !== undefined)
+            prepared.approvalSettledBy.delete(event.toolCallId);
         pushContent({
             type: "tool_end",
             toolCallId: event.toolCallId,
             toolName: event.toolName,
             ...(toolLabels.get(event.toolName) !== undefined ? { label: toolLabels.get(event.toolName) } : {}),
             isError: event.isError,
-            ...toolEndBodyFrom(event.result, event.isError),
+            ...toolEndBodyFrom(event.result, event.isError, settledBy),
             ...ident(),
         });
         announceWorkspaceMove();
@@ -3596,6 +3621,14 @@ export class Runner {
             if (decision !== "allow" && decision !== "deny") {
                 throw new CheckpointError("checkpoint.invalid_outcome", `resume decision "${describeSuppliedValue(decision)}" is outside the policy_ask domain — a decide is exactly "allow" or "deny"; refusing pre-CAS, the checkpoint stays pending`);
             }
+            const settledBy = decide.settledBy;
+            if (settledBy !== undefined && !isApprovalSettledBy(settledBy)) {
+                throw new CheckpointError("checkpoint.invalid_outcome", `resume settledBy "${describeSuppliedValue(settledBy)}" is outside the settlement vocabulary — it is exactly "human", "timeout" or "aborted" (or omitted); refusing pre-CAS, the checkpoint stays pending`, { field: "settledBy" });
+            }
+            if (settledBy !== undefined && settledBy !== "human" && decision === "allow") {
+                throw new CheckpointError("checkpoint.invalid_outcome", `resume carries decision "allow" with settledBy "${settledBy}" — a non-human settlement is a fail-closed end (nobody answered), so it cannot be the source of an approval that EXECUTES; ` +
+                    "supply \"human\", or omit the field if the allow came from configuration rather than a person; refusing pre-CAS, the checkpoint stays pending", { field: "settledBy" });
+            }
             const reason = decide.reason;
             assertOutcomeText(reason, "reason");
             plainPolicyOutcome = {
@@ -3606,6 +3639,7 @@ export class Runner {
                 ...(updatedInput !== undefined ? { updatedInput } : {}),
                 ...(reason !== undefined ? { reason } : {}),
                 ...(redeemedAnswer !== undefined ? { answer: redeemedAnswer } : {}),
+                ...(settledBy !== undefined ? { settledBy } : {}),
             };
             if (plainPolicyOutcome.decision === "deny" && plainPolicyOutcome.reason && sanitizeUntrustedText(plainPolicyOutcome.reason) !== plainPolicyOutcome.reason) {
                 throw new CheckpointError("checkpoint.invalid_outcome", "resume deny/reject reason must not contain a </system-reminder> tag");
@@ -3802,9 +3836,14 @@ export class Runner {
         const resolvedArgs = pendingAction.toolName === ASK_USER_QUESTION_TOOL_NAME ? pendingAction.args : (outcome.updatedInput !== undefined ? outcome.updatedInput : pendingAction.args);
         const pendingLabel = (() => { const l = prepared.tools.find((t) => t.name === pendingAction.toolName)?.label; return l !== undefined && l !== pendingAction.toolName ? { label: l } : {}; })();
         emit({ type: "tool_start", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, args: resolvedArgs });
-        const emitEnd = (isError, result) => emit({ type: "tool_end", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, isError, ...toolEndBodyFrom(result, isError) });
+        const emitEnd = (isError, result) => emit({ type: "tool_end", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, isError, ...toolEndBodyFrom(result, isError, outcome.settledBy) });
         if (outcome.decision === "deny") {
-            const reason = outcome.reason ? delimitUntrusted("reviewer note", outcome.reason) : `The pending tool call "${pendingAction.toolName}" was denied by an approver.`;
+            const defaultDenial = outcome.settledBy === "timeout"
+                ? `No one answered the approval request for the pending tool call "${pendingAction.toolName}" — the approval window elapsed with no answer, so it was not executed.`
+                : outcome.settledBy === "aborted"
+                    ? `The approval for the pending tool call "${pendingAction.toolName}" ended without anyone deciding it (it was cancelled or could not be delivered), so it was not executed.`
+                    : `The pending tool call "${pendingAction.toolName}" was denied by an approver.`;
+            const reason = outcome.reason ? delimitUntrusted("reviewer note", outcome.reason) : defaultDenial;
             emitEnd(true, { content: formatHookFeedback(reason) });
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(reason), true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);
@@ -3969,6 +4008,9 @@ export class Runner {
                     ...this.compactionHookOptions(spec, prepared.sessionId, "auto"),
                 });
                 this.recordCompactionReuse(prepared, finishComp);
+                if (finishComp.unevaluableWindow) {
+                    discloseUnevaluableWindow(finishComp.unevaluableWindow, prepared, spec.tracer ?? this.deps.tracer, spec.taskId ?? prepared.sessionId, this.deps.onError);
+                }
                 comp = finishComp;
             }
             catch (err) {

package/dist/core/runner/tool-output-projection.js

@@ -62,7 +62,7 @@ const CC_DETAIL_TYPES = new Set([
     "agent", "task", "task-list", "task-output", "workflow-run",
     "web-fetch", "web-search", "todo", "cron-create", "cron-delete", "cron-list", "image",
     "task-stop", "tool-search", "repo-map", "fork", "enter-plan-mode", "exit-plan-mode",
-    "monitor-start", "path_not_in_root", "readonly_out_of_root",
+    "monitor-start", "path_not_in_root", "readonly_out_of_root", "bash_invalid_timeout",
     "report-findings", "schedule-wakeup", "send-message", "agent-transcript", "a2a", "document",
 ]);
 export const structuredFrom = (result) => {

package/dist/core/tool-policy.d.ts

@@ -8,12 +8,16 @@ export interface ToolCallRequest {
         suspendCount: number;
     };
 }
-export type DecisionReason = "rule" | "mode" | "hook" | "safety" | "classifier";
+export type DecisionReason = "rule" | "mode" | "hook" | "safety" | "classifier" | "persisted_rule";
+export type ApprovalSettledBy = "human" | "timeout" | "aborted";
+export declare const APPROVAL_SETTLED_BY_VALUES: readonly ApprovalSettledBy[];
+export declare function isApprovalSettledBy(v: unknown): v is ApprovalSettledBy;
 export type PermissionResult = {
     action: "allow";
     updatedInput?: unknown;
     message?: string;
     decisionReason?: DecisionReason;
+    settledBy?: Extract<ApprovalSettledBy, "human">;
 } | {
     action: "ask";
     updatedInput?: unknown;
@@ -25,6 +29,7 @@ export type PermissionResult = {
     updatedInput?: unknown;
     message?: string;
     decisionReason?: DecisionReason;
+    settledBy?: ApprovalSettledBy;
 };
 export declare function decisionText(d: PermissionResult): string | undefined;
 export interface ToolPolicy {
@@ -43,6 +48,12 @@ export declare function toolPolicyNameSets(p: ToolPolicy | undefined): readonly
 export declare function createAllowDenyPolicy(opts: {
     allow?: string[];
     deny?: string[];
+    onInvalidName?: "throw" | "skip";
+    onInvalidNameIssue?: (issue: {
+        entry: string;
+        list: "allow" | "deny";
+        message: string;
+    }) => void;
 }): NamedToolPolicy;
 export declare function createApprovalPolicy(opts: {
     requireApproval: string[];
@@ -81,6 +92,7 @@ export interface AskRequest {
     args: unknown;
     readonly preview?: unknown;
     readonly boundInputHash?: string;
+    readonly ruleSuggestions?: readonly import("./permission-rule-model.js").RuleSuggestion[];
     message: string;
     readonly principal?: string;
     readonly sourceTaskId?: string;