@sema-agent/core 5.18.0 → 5.19.0

package/dist/core/runner/prepare-task.js

@@ -20,7 +20,7 @@ import { createSubagentWorktreeHelper, forkGovernanceDenial } from "../../agents
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import { askApproverIdentity, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
+import { askApproverIdentity, combinePolicies, isApprovalSettledBy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
 const PERSISTED_RULE_TOOL = "Bash";
 import { findAdmittingRule, suggestRulesForCommand } from "../permission-rule-model.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
@@ -28,7 +28,7 @@ import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentList
 import { inlineUntrusted } from "../untrusted-text.js";
 import { emitTrace } from "../trace.js";
 import { createSessionRulePolicy } from "./session-rule-policy.js";
-import { cloneObserverInput, createHookEnvCapabilities, formatHookFeedback, runToolGate } from "../hooks.js";
+import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, runToolGate } from "../hooks.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
@@ -1057,6 +1057,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const ownOrgVerdictRef = { current: undefined };
         const orgAdmissionCheckpointState = () => inheritedAdmittedOrgScopes !== undefined || ownOrgVerdictRef.current !== undefined || orgGovernedProvenance;
         const frozenOnAsk = spec.onAsk ?? deps.onAsk;
+        const hookEnvSource = (ownedEnv ?? deps.executionEnv) != null ? executionEnv : undefined;
+        const notifyOwnHookCrash = (err) => {
+            try {
+                deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId });
+            }
+            catch {
+            }
+        };
         const frozenOnQuestion = spec.onQuestion ?? deps.onQuestion;
         const inheritedGateForChildren = () => {
             const ancestorRules = [
@@ -1066,8 +1074,25 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const ownCallerPolicy = lockedPreflight.toolPolicy;
             const durableMandate = runtimeCaps?.forceDurableGate === true ||
                 (spec.durableApproval !== undefined && !isLiveApproverSeat(frozenOnAsk));
+            const ownPreToolUse = hooks?.preToolUse;
+            const hookConstraint = ownPreToolUse !== undefined &&
+                !(inheritedParentConstraints ?? []).some((pc) => pc.preToolUse === ownPreToolUse &&
+                    askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
+                    (pc.durableMandate === true) === durableMandate &&
+                    pc.hookEnv === hookEnvSource)
+                ? [
+                    {
+                        policy: createPreToolUseConstraintPolicy(ownPreToolUse, hookEnvFace, notifyOwnHookCrash),
+                        preToolUse: ownPreToolUse,
+                        ...(hookEnvSource !== undefined ? { hookEnv: hookEnvSource } : {}),
+                        ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
+                        ...(durableMandate ? { durableMandate: true } : {}),
+                    },
+                ]
+                : [];
             const parentConstraints = [
                 ...(inheritedParentConstraints ?? []),
+                ...hookConstraint,
                 ...(ownCallerPolicy !== undefined
                     ? [
                         {
@@ -2920,6 +2945,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             auditPolicyNames(layer);
         const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
         const basePolicyForResumeEdit = lockedPreflight.toolPolicy;
+        const hooks = spec.hooks ?? deps.hooks;
         const sameInstanceAncestorCount = policy === undefined ? 0 : (inheritedParentConstraints ?? []).reduce((n, pc) => (pc.policy === policy ? n + 1 : n), 0);
         const sharedFirstDecision = new Map();
         const SHARED_FIRST_DECISION_CAP = 256;
@@ -3067,125 +3093,133 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 editArgs = rr.updatedInput;
             }
         };
-        const parentConstraintWrappers = (inheritedParentConstraints ?? []).map((pc) => policy !== undefined && pc.policy === policy
-            ? {
-                check: async (creq, csignal) => {
-                    const first = sharedFirstDecision.get(creq.toolCallId);
-                    if (first === undefined) {
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy could not be arbitrated for "${creq.toolName}" ` +
-                                `(shared-instance first decision unavailable); denied fail-closed`,
-                        };
-                    }
-                    if (first.action === "deny")
-                        return first;
-                    if (first.action === "allow")
-                        return { action: "allow" };
-                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
-                        return first;
-                    }
-                    if (pc.durableMandate === true) {
-                        if (resolveCheckpointStore(spec, deps) !== undefined &&
-                            (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
-                            markInheritedUnavailable(creq.toolCallId)) {
-                            return first;
+        const parentConstraintWrappers = (inheritedParentConstraints ?? []).map((pc) => pc.preToolUse !== undefined &&
+            pc.preToolUse === hooks?.preToolUse &&
+            pc.durableMandate !== true &&
+            askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
+            pc.hookEnv === hookEnvSource
+            ? { check: () => ({ action: "allow" }) }
+            : policy !== undefined && pc.policy === policy
+                ? {
+                    check: async (creq, csignal) => {
+                        const first = sharedFirstDecision.get(creq.toolCallId);
+                        if (first === undefined) {
+                            return {
+                                action: "deny",
+                                message: `inherited parent policy could not be arbitrated for "${creq.toolName}" ` +
+                                    `(shared-instance first decision unavailable); denied fail-closed`,
+                            };
                         }
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
-                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
-                        };
-                    }
-                    const presentedArgs = creq.args;
-                    const askT0 = now();
-                    const resolved = await resolveAsk({
-                        toolName: creq.toolName,
-                        toolCallId: creq.toolCallId,
-                        args: presentedArgs,
-                        ...ruleSuggestionsOf(creq.toolName, presentedArgs),
-                        message: first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
-                        ...askSourceIdentity(),
-                        ...riskAxesOf(creq.toolName),
-                        ...(first.action === "ask" && first.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                    }, pc.onAsk, csignal ?? abortController.signal);
-                    const askWaitMs = Math.max(0, now() - askT0);
-                    if (resolved.action === "deny" && resolved.approverUnavailable === true) {
-                        if (markInheritedUnavailable(creq.toolCallId))
+                        if (first.action === "deny")
+                            return first;
+                        if (first.action === "allow")
+                            return { action: "allow" };
+                        if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
                             return first;
-                        return {
-                            action: "deny",
-                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
-                        };
-                    }
-                    if (resolved.action !== "allow")
-                        return resolved;
-                    if (resolved.updatedInput !== undefined) {
-                        return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal);
-                    }
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
-                    return { action: "allow" };
-                },
-            }
-            : {
-                check: async (creq, csignal) => {
-                    let decision;
-                    try {
-                        decision = await pc.policy.check(creq, csignal ?? abortController.signal);
-                    }
-                    catch (err) {
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
-                        };
-                    }
-                    if (decision.action !== "ask")
-                        return decision;
-                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
-                        return decision;
-                    }
-                    if (pc.durableMandate === true) {
-                        if (resolveCheckpointStore(spec, deps) !== undefined &&
-                            (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
-                            markInheritedUnavailable(creq.toolCallId)) {
-                            return decision;
                         }
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
-                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
-                        };
-                    }
-                    const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
-                    const askT0 = now();
-                    const resolved = await resolveAsk({
-                        toolName: creq.toolName,
-                        toolCallId: creq.toolCallId,
-                        args: presentedArgs,
-                        ...ruleSuggestionsOf(creq.toolName, presentedArgs),
-                        message: decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
-                        ...askSourceIdentity(),
-                        ...riskAxesOf(creq.toolName),
-                        ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                    }, pc.onAsk, csignal ?? abortController.signal);
-                    const askWaitMs = Math.max(0, now() - askT0);
-                    if (resolved.action === "deny" && resolved.approverUnavailable === true) {
-                        if (markInheritedUnavailable(creq.toolCallId))
+                        if (pc.durableMandate === true) {
+                            if (resolveCheckpointStore(spec, deps) !== undefined &&
+                                (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
+                                markInheritedUnavailable(creq.toolCallId)) {
+                                return first;
+                            }
+                            return {
+                                action: "deny",
+                                message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                                    `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
+                            };
+                        }
+                        const presentedArgs = creq.args;
+                        const askT0 = now();
+                        const resolved = await resolveAsk({
+                            toolName: creq.toolName,
+                            toolCallId: creq.toolCallId,
+                            args: presentedArgs,
+                            ...ruleSuggestionsOf(creq.toolName, presentedArgs),
+                            message: first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                            ...askSourceIdentity(),
+                            ...riskAxesOf(creq.toolName),
+                            ...(first.action === "ask" && first.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                        }, pc.onAsk, csignal ?? abortController.signal);
+                        const askWaitMs = Math.max(0, now() - askT0);
+                        if (resolved.action === "deny" && resolved.approverUnavailable === true) {
+                            if (markInheritedUnavailable(creq.toolCallId))
+                                return first;
+                            return {
+                                action: "deny",
+                                message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
+                            };
+                        }
+                        if (resolved.action !== "allow")
+                            return resolved;
+                        if (resolved.updatedInput !== undefined) {
+                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal);
+                        }
+                        recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
+                        return { action: "allow" };
+                    },
+                }
+                : {
+                    check: async (creq, csignal) => {
+                        let decision;
+                        try {
+                            decision = await pc.policy.check(creq, csignal ?? abortController.signal);
+                        }
+                        catch (err) {
+                            return {
+                                action: "deny",
+                                message: `inherited parent policy errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
+                            };
+                        }
+                        if (decision.action !== "ask")
                             return decision;
-                        return {
-                            action: "deny",
-                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
-                        };
-                    }
-                    if (resolved.action !== "allow")
-                        return resolved;
-                    if (resolved.updatedInput !== undefined) {
-                        return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal);
-                    }
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
-                    return decision.updatedInput !== undefined ? { ...resolved, updatedInput: decision.updatedInput } : resolved;
-                },
-            });
+                        if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
+                            return decision;
+                        }
+                        if (pc.durableMandate === true) {
+                            if (resolveCheckpointStore(spec, deps) !== undefined &&
+                                (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
+                                markInheritedUnavailable(creq.toolCallId)) {
+                                return decision;
+                            }
+                            return {
+                                action: "deny",
+                                message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                                    `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
+                            };
+                        }
+                        const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
+                        const askT0 = now();
+                        const resolved = await resolveAsk({
+                            toolName: creq.toolName,
+                            toolCallId: creq.toolCallId,
+                            args: presentedArgs,
+                            ...ruleSuggestionsOf(creq.toolName, presentedArgs),
+                            message: decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                            ...askSourceIdentity(),
+                            ...riskAxesOf(creq.toolName),
+                            ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                        }, pc.onAsk, csignal ?? abortController.signal);
+                        const askWaitMs = Math.max(0, now() - askT0);
+                        if (resolved.action === "deny" && resolved.approverUnavailable === true) {
+                            if (markInheritedUnavailable(creq.toolCallId))
+                                return decision;
+                            return {
+                                action: "deny",
+                                message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
+                            };
+                        }
+                        if (resolved.action !== "allow")
+                            return resolved;
+                        if (resolved.updatedInput !== undefined) {
+                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal);
+                        }
+                        if (pc.preToolUse === undefined) {
+                            recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
+                        }
+                        return decision.updatedInput !== undefined ? { ...resolved, updatedInput: decision.updatedInput } : resolved;
+                    },
+                });
         const rewriteCapableLayers = policy !== undefined || parentConstraintWrappers.length > 0;
         const rewriteEmitterIndex = new Map();
         const rewriteCapableChain = [
@@ -3269,7 +3303,6 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 },
             }
             : foldedPolicy;
-        const hooks = spec.hooks ?? deps.hooks;
         const onAsk = spec.onAsk ?? deps.onAsk;
         const handWriteTools = handsEnabled && spec.handsReadOnly !== true
             ? Object.keys(HAND_TOOL_EFFECTS).filter((name) => {
@@ -3304,6 +3337,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         const preToolContexts = new Map();
         const blockedToolCalls = new Set();
+        const approvalSettledBy = new Map();
         const blockedTracked = Boolean(hooks?.postToolUse || hooks?.preToolUse || hooks?.postToolUseFailure || hooks?.postToolBatch);
         const restoreSurfaceGap = ownedEnv !== undefined && isRemoteExecutionEnv(ownedEnv) && ownedEnv.capabilities.suspendable ? missingRestoreSurface(ownedEnv) : [];
         const incompleteSuspendAdapter = restoreSurfaceGap.length > 0 ? restoreSurfaceGap : undefined;
@@ -3390,7 +3424,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const hookEnvFace = hookContextConsumerWired && (ownedEnv ?? deps.executionEnv) != null ? createHookEnvCapabilities(executionEnv) : undefined;
         if (effectivePolicy || hooks?.preToolUse || egressTools.size > 0 || irreversibleTools.size > 0 || resourceSuspendEligible || platformSuspendArmed || spec.enablePlanMode === true) {
             const adjudicate = effectivePolicy
-                ? (req) => raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot }, abortController.signal)), abortController.signal, () => ({
+                ? (req) => raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}) }, abortController.signal)), abortController.signal, () => ({
                     action: "deny",
                     message: "policy check aborted (task timed out or cancelled)",
                 }))
@@ -3917,7 +3951,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             if (!presented.ok) {
                                 throw new ParkRefusal(`the stored form of "${req.toolName}"'s arguments could not be presented for re-adjudication (${describeThrown(presented.cause)})`, { cause: presented.cause });
                             }
-                            const reprojected = refuseOutOfContractDecision(await basePolicyForResumeEdit.check({ toolName: req.toolName, args: presented.value, toolCallId: req.toolCallId }, abortController.signal));
+                            const reprojected = refuseOutOfContractDecision(await basePolicyForResumeEdit.check({
+                                toolName: req.toolName,
+                                args: presented.value,
+                                toolCallId: req.toolCallId,
+                                ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}),
+                            }, abortController.signal));
                             const demanded = reprojected.updatedInput !== undefined ? tryCloneArgs(reprojected.updatedInput) : undefined;
                             const rewroteTheFiledValue = reprojected.updatedInput !== undefined &&
                                 !(demanded?.ok === true &&
@@ -4156,6 +4195,17 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     if (blockedTracked && (result.block || result.suspend)) {
                         blockedToolCalls.add(e.toolCallId);
                     }
+                    const reported = result.settledBy;
+                    if (reported !== undefined) {
+                        const settling = result.block === true;
+                        if (!isApprovalSettledBy(reported) || (!settling && reported !== "human")) {
+                            deps.onError?.(new Error(`a tool-gate settlement reported settledBy "${String(reported)}" on ${settling ? "a blocked" : "an executing"} call — ` +
+                                `it is one of "human" / "timeout" / "aborted", and only "human" can be the source of a call that runs; the frame carries no source`), { phase: "config", sessionId });
+                        }
+                        else {
+                            approvalSettledBy.set(e.toolCallId, reported);
+                        }
+                    }
                     return result.block
                         ? { block: true, reason: result.reason }
                         : result.updatedInput !== undefined
@@ -4444,7 +4494,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             : undefined;
         overheadState.promptChars = systemPrompt.length;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettledBy, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.d.ts

@@ -5,6 +5,7 @@ import { type TaskOutcome } from "../task-outcome.js";
 import { type SideQuerySpec, type SideQueryResult } from "../side-query.js";
 import type { SessionStore } from "../session.js";
 import { type RecoveredOrphan } from "../session-reconcile.js";
+import { type ApprovalSettledBy } from "../tool-policy.js";
 import type { AgentDefinition, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream } from "../types.js";
 export type ResumeTaskConfig = Omit<TaskSpec, "objective" | "sessionId">;
 interface ResumeRun {
@@ -17,12 +18,13 @@ interface ResumeRun {
     onEnvRestoreFailed?: (reason: ReopenReason) => Promise<void>;
     decisionDelivered?: boolean;
 }
-declare function toolEndBodyFrom(result: unknown, isError: boolean): {
+declare function toolEndBodyFrom(result: unknown, isError: boolean, settledBy?: ApprovalSettledBy): {
     output?: unknown;
     truncated?: boolean;
     totalChars?: number;
     structured?: unknown;
     errorCode?: string;
+    settledBy?: ApprovalSettledBy;
 };
 export declare function reconciledToolEndBody(orphan: Pick<RecoveredOrphan, "text" | "errorKind">): ReturnType<typeof toolEndBodyFrom>;
 export declare const GOVERNANCE_READ_STALLED: unique symbol;

package/dist/core/runner/runtask.js

@@ -38,7 +38,7 @@ import { delimitUntrusted, inlineUntrusted, sanitizeUntrustedText } from "../unt
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
-import { refuseOutOfContractDecision, toolPolicyNameSets } from "../tool-policy.js";
+import { isApprovalSettledBy, refuseOutOfContractDecision, toolPolicyNameSets } from "../tool-policy.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { discloseDroppedPending, isDelegatedAgentTerminal, PendingSessionNotifications, renderTaskNotificationXml, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
 import { ToolDetachHub } from "../tool-detach.js";
@@ -126,7 +126,7 @@ function resumeDecisionWasNegative(resume) {
 }
 const DEFERRED_REISSUE = "[DEFERRED] This tool call shared a batch with a call that suspended for durable approval, so it was " +
     "NOT executed on resume. If you still need it, issue it again now.";
-function toolEndBodyFrom(result, isError) {
+function toolEndBodyFrom(result, isError, settledBy) {
     const o = toolOutputFrom(result);
     const st = structuredFrom(result);
     const code = isError ? result?.details?.code : undefined;
@@ -134,6 +134,7 @@ function toolEndBodyFrom(result, isError) {
         ...(o !== undefined ? { output: o.output, ...(o.truncated ? { truncated: true } : {}), ...(o.totalChars !== undefined ? { totalChars: o.totalChars } : {}) } : {}),
         ...(st !== undefined ? { structured: st } : {}),
         ...(typeof code === "string" ? { errorCode: code } : {}),
+        ...(settledBy !== undefined ? { settledBy } : {}),
     };
 }
 export function reconciledToolEndBody(orphan) {
@@ -1202,13 +1203,16 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
                     prepared.lspDiagnostics.nudge(p);
             }
         }
+        const settledBy = prepared.approvalSettledBy.get(event.toolCallId);
+        if (settledBy !== undefined)
+            prepared.approvalSettledBy.delete(event.toolCallId);
         pushContent({
             type: "tool_end",
             toolCallId: event.toolCallId,
             toolName: event.toolName,
             ...(toolLabels.get(event.toolName) !== undefined ? { label: toolLabels.get(event.toolName) } : {}),
             isError: event.isError,
-            ...toolEndBodyFrom(event.result, event.isError),
+            ...toolEndBodyFrom(event.result, event.isError, settledBy),
             ...ident(),
         });
         announceWorkspaceMove();
@@ -3617,6 +3621,14 @@ export class Runner {
             if (decision !== "allow" && decision !== "deny") {
                 throw new CheckpointError("checkpoint.invalid_outcome", `resume decision "${describeSuppliedValue(decision)}" is outside the policy_ask domain — a decide is exactly "allow" or "deny"; refusing pre-CAS, the checkpoint stays pending`);
             }
+            const settledBy = decide.settledBy;
+            if (settledBy !== undefined && !isApprovalSettledBy(settledBy)) {
+                throw new CheckpointError("checkpoint.invalid_outcome", `resume settledBy "${describeSuppliedValue(settledBy)}" is outside the settlement vocabulary — it is exactly "human", "timeout" or "aborted" (or omitted); refusing pre-CAS, the checkpoint stays pending`, { field: "settledBy" });
+            }
+            if (settledBy !== undefined && settledBy !== "human" && decision === "allow") {
+                throw new CheckpointError("checkpoint.invalid_outcome", `resume carries decision "allow" with settledBy "${settledBy}" — a non-human settlement is a fail-closed end (nobody answered), so it cannot be the source of an approval that EXECUTES; ` +
+                    "supply \"human\", or omit the field if the allow came from configuration rather than a person; refusing pre-CAS, the checkpoint stays pending", { field: "settledBy" });
+            }
             const reason = decide.reason;
             assertOutcomeText(reason, "reason");
             plainPolicyOutcome = {
@@ -3627,6 +3639,7 @@ export class Runner {
                 ...(updatedInput !== undefined ? { updatedInput } : {}),
                 ...(reason !== undefined ? { reason } : {}),
                 ...(redeemedAnswer !== undefined ? { answer: redeemedAnswer } : {}),
+                ...(settledBy !== undefined ? { settledBy } : {}),
             };
             if (plainPolicyOutcome.decision === "deny" && plainPolicyOutcome.reason && sanitizeUntrustedText(plainPolicyOutcome.reason) !== plainPolicyOutcome.reason) {
                 throw new CheckpointError("checkpoint.invalid_outcome", "resume deny/reject reason must not contain a </system-reminder> tag");
@@ -3823,9 +3836,14 @@ export class Runner {
         const resolvedArgs = pendingAction.toolName === ASK_USER_QUESTION_TOOL_NAME ? pendingAction.args : (outcome.updatedInput !== undefined ? outcome.updatedInput : pendingAction.args);
         const pendingLabel = (() => { const l = prepared.tools.find((t) => t.name === pendingAction.toolName)?.label; return l !== undefined && l !== pendingAction.toolName ? { label: l } : {}; })();
         emit({ type: "tool_start", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, args: resolvedArgs });
-        const emitEnd = (isError, result) => emit({ type: "tool_end", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, isError, ...toolEndBodyFrom(result, isError) });
+        const emitEnd = (isError, result) => emit({ type: "tool_end", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, isError, ...toolEndBodyFrom(result, isError, outcome.settledBy) });
         if (outcome.decision === "deny") {
-            const reason = outcome.reason ? delimitUntrusted("reviewer note", outcome.reason) : `The pending tool call "${pendingAction.toolName}" was denied by an approver.`;
+            const defaultDenial = outcome.settledBy === "timeout"
+                ? `No one answered the approval request for the pending tool call "${pendingAction.toolName}" — the approval window elapsed with no answer, so it was not executed.`
+                : outcome.settledBy === "aborted"
+                    ? `The approval for the pending tool call "${pendingAction.toolName}" ended without anyone deciding it (it was cancelled or could not be delivered), so it was not executed.`
+                    : `The pending tool call "${pendingAction.toolName}" was denied by an approver.`;
+            const reason = outcome.reason ? delimitUntrusted("reviewer note", outcome.reason) : defaultDenial;
             emitEnd(true, { content: formatHookFeedback(reason) });
             const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, formatHookFeedback(reason), true));
             emitCommitted(eid, "toolResult", pendingAction.toolCallId);
@@ -3835,7 +3853,12 @@ export class Runner {
             throw new CheckpointError("checkpoint.invalid_outcome", `pending action reached the resolver with decision "${String(outcome.decision)}" — only "allow" executes and only "deny" injects a denial; refusing to execute`);
         }
         if (outcome.decision === "allow" && outcome.updatedInput !== undefined && prepared.basePolicyForResumeEdit) {
-            const rechecked = refuseOutOfContractDecision(await prepared.basePolicyForResumeEdit.check({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId }, prepared.abortController.signal));
+            const rechecked = refuseOutOfContractDecision(await prepared.basePolicyForResumeEdit.check({
+                toolName: pendingAction.toolName,
+                args: resolvedArgs,
+                toolCallId: pendingAction.toolCallId,
+                ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}),
+            }, prepared.abortController.signal));
             if (rechecked.action === "deny") {
                 const editedDenial = formatHookFeedback(`The approver EDITED this call's input; the edited call is denied by the deployment's tool policy and was not executed${rechecked.message ? `: ${rechecked.message}` : ""}.`);
                 emitEnd(true, { content: editedDenial });
@@ -3845,7 +3868,12 @@ export class Runner {
             }
         }
         if (prepared.denyNarrowingPolicy) {
-            const narrowed = refuseOutOfContractDecision(await prepared.denyNarrowingPolicy.check({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId }, prepared.abortController.signal));
+            const narrowed = refuseOutOfContractDecision(await prepared.denyNarrowingPolicy.check({
+                toolName: pendingAction.toolName,
+                args: resolvedArgs,
+                toolCallId: pendingAction.toolCallId,
+                ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}),
+            }, prepared.abortController.signal));
             if (narrowed.action === "deny") {
                 const narrowedDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by a session rule and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`);
                 emitEnd(true, { content: narrowedDenial });

package/dist/core/runner/session-rule-policy.js

@@ -58,7 +58,7 @@ export function createSessionRulePolicy(rules, opts) {
                     if (typeof path !== "string" || path.length === 0) {
                         return deny(`write tool "${req.toolName}" denied: session rule confines writes to allowDirs but the call has no resolvable path`);
                     }
-                    const canon = await canonicalizeTarget(env, path, signal, rootPath);
+                    const canon = await canonicalizeTarget(env, path, signal, req.cwd ?? rootPath);
                     if (!canon.ok) {
                         return deny(`write to "${path}" denied: its real target could not be resolved against the session-rule allowDirs`);
                     }

package/dist/core/sensitive-path-policy.js

@@ -64,7 +64,7 @@ export function createSensitivePathPolicy(opts) {
             const path = writeTargetPath(canonical, req.args);
             if (typeof path !== "string" || path.length === 0)
                 return { action: "allow" };
-            const canon = await canonicalizeTarget(opts.env, path, signal, opts.rootPath);
+            const canon = await canonicalizeTarget(opts.env, path, signal, req.cwd ?? opts.rootPath);
             if (!canon.ok) {
                 if (canon.unresolvedSymlink) {
                     return {

package/dist/core/tool-policy.d.ts

@@ -2,6 +2,7 @@ export interface ToolCallRequest {
     toolName: string;
     args: unknown;
     toolCallId: string;
+    cwd?: string;
     budget?: {
         resourceRemainingMicroUsd?: number;
         resourceSpentMicroUsd: number;
@@ -9,11 +10,15 @@ export interface ToolCallRequest {
     };
 }
 export type DecisionReason = "rule" | "mode" | "hook" | "safety" | "classifier" | "persisted_rule";
+export type ApprovalSettledBy = "human" | "timeout" | "aborted";
+export declare const APPROVAL_SETTLED_BY_VALUES: readonly ApprovalSettledBy[];
+export declare function isApprovalSettledBy(v: unknown): v is ApprovalSettledBy;
 export type PermissionResult = {
     action: "allow";
     updatedInput?: unknown;
     message?: string;
     decisionReason?: DecisionReason;
+    settledBy?: Extract<ApprovalSettledBy, "human">;
 } | {
     action: "ask";
     updatedInput?: unknown;
@@ -25,6 +30,7 @@ export type PermissionResult = {
     updatedInput?: unknown;
     message?: string;
     decisionReason?: DecisionReason;
+    settledBy?: ApprovalSettledBy;
 };
 export declare function decisionText(d: PermissionResult): string | undefined;
 export interface ToolPolicy {