@sema-agent/core 5.18.1 → 5.20.0

package/dist/core/runner/prepare-task.js

@@ -28,7 +28,7 @@ import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentList
 import { inlineUntrusted } from "../untrusted-text.js";
 import { emitTrace } from "../trace.js";
 import { createSessionRulePolicy } from "./session-rule-policy.js";
-import { cloneObserverInput, createHookEnvCapabilities, formatHookFeedback, runToolGate } from "../hooks.js";
+import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, runToolGate } from "../hooks.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
@@ -1057,6 +1057,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const ownOrgVerdictRef = { current: undefined };
         const orgAdmissionCheckpointState = () => inheritedAdmittedOrgScopes !== undefined || ownOrgVerdictRef.current !== undefined || orgGovernedProvenance;
         const frozenOnAsk = spec.onAsk ?? deps.onAsk;
+        const hookEnvSource = (ownedEnv ?? deps.executionEnv) != null ? executionEnv : undefined;
+        const notifyOwnHookCrash = (err) => {
+            try {
+                deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId });
+            }
+            catch {
+            }
+        };
         const frozenOnQuestion = spec.onQuestion ?? deps.onQuestion;
         const inheritedGateForChildren = () => {
             const ancestorRules = [
@@ -1066,8 +1074,25 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const ownCallerPolicy = lockedPreflight.toolPolicy;
             const durableMandate = runtimeCaps?.forceDurableGate === true ||
                 (spec.durableApproval !== undefined && !isLiveApproverSeat(frozenOnAsk));
+            const ownPreToolUse = preToolUseObservational ? undefined : hooks?.preToolUse;
+            const hookConstraint = ownPreToolUse !== undefined &&
+                !(inheritedParentConstraints ?? []).some((pc) => pc.preToolUse === ownPreToolUse &&
+                    askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
+                    (pc.durableMandate === true) === durableMandate &&
+                    pc.hookEnv === hookEnvSource)
+                ? [
+                    {
+                        policy: createPreToolUseConstraintPolicy(ownPreToolUse, hookEnvFace, notifyOwnHookCrash),
+                        preToolUse: ownPreToolUse,
+                        ...(hookEnvSource !== undefined ? { hookEnv: hookEnvSource } : {}),
+                        ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
+                        ...(durableMandate ? { durableMandate: true } : {}),
+                    },
+                ]
+                : [];
             const parentConstraints = [
                 ...(inheritedParentConstraints ?? []),
+                ...hookConstraint,
                 ...(ownCallerPolicy !== undefined
                     ? [
                         {
@@ -2920,6 +2945,25 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             auditPolicyNames(layer);
         const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
         const basePolicyForResumeEdit = lockedPreflight.toolPolicy;
+        const hooks = spec.hooks ?? deps.hooks;
+        const preToolUseObservational = hooks?.preToolUse !== undefined && hooks.preToolUseObservational === true;
+        const ownGatePreToolUse = !preToolUseObservational
+            ? hooks?.preToolUse
+            : async (toolName, input, ctx) => {
+                const r = await hooks.preToolUse(toolName, cloneObserverInput(input), ctx);
+                if (r === undefined)
+                    return undefined;
+                try {
+                    const action = typeof r.action === "string" ? r.action : "(non-string action)";
+                    deps.onError?.(new Error(`a PreToolUse hook declared observational (Hooks.preToolUseObservational) returned a decision ("${action}") while screening ` +
+                        `"${toolName}" — the decision was NOT adopted and the call proceeded as if the hook had no opinion. ` +
+                        `A declared-observational face must return undefined; drop the declaration if its verdicts are meant to count ` +
+                        `(they then also travel to delegated children as an inherited screening constraint).`), { phase: "hook", sessionId, classification: "observational-hook-verdict-ignored" });
+                }
+                catch {
+                }
+                return undefined;
+            };
         const sameInstanceAncestorCount = policy === undefined ? 0 : (inheritedParentConstraints ?? []).reduce((n, pc) => (pc.policy === policy ? n + 1 : n), 0);
         const sharedFirstDecision = new Map();
         const SHARED_FIRST_DECISION_CAP = 256;
@@ -3067,125 +3111,134 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 editArgs = rr.updatedInput;
             }
         };
-        const parentConstraintWrappers = (inheritedParentConstraints ?? []).map((pc) => policy !== undefined && pc.policy === policy
-            ? {
-                check: async (creq, csignal) => {
-                    const first = sharedFirstDecision.get(creq.toolCallId);
-                    if (first === undefined) {
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy could not be arbitrated for "${creq.toolName}" ` +
-                                `(shared-instance first decision unavailable); denied fail-closed`,
-                        };
-                    }
-                    if (first.action === "deny")
-                        return first;
-                    if (first.action === "allow")
-                        return { action: "allow" };
-                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
-                        return first;
-                    }
-                    if (pc.durableMandate === true) {
-                        if (resolveCheckpointStore(spec, deps) !== undefined &&
-                            (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
-                            markInheritedUnavailable(creq.toolCallId)) {
-                            return first;
+        const parentConstraintWrappers = (inheritedParentConstraints ?? []).map((pc) => pc.preToolUse !== undefined &&
+            pc.preToolUse === hooks?.preToolUse &&
+            !preToolUseObservational &&
+            pc.durableMandate !== true &&
+            askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
+            pc.hookEnv === hookEnvSource
+            ? { check: () => ({ action: "allow" }) }
+            : policy !== undefined && pc.policy === policy
+                ? {
+                    check: async (creq, csignal) => {
+                        const first = sharedFirstDecision.get(creq.toolCallId);
+                        if (first === undefined) {
+                            return {
+                                action: "deny",
+                                message: `inherited parent policy could not be arbitrated for "${creq.toolName}" ` +
+                                    `(shared-instance first decision unavailable); denied fail-closed`,
+                            };
                         }
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
-                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
-                        };
-                    }
-                    const presentedArgs = creq.args;
-                    const askT0 = now();
-                    const resolved = await resolveAsk({
-                        toolName: creq.toolName,
-                        toolCallId: creq.toolCallId,
-                        args: presentedArgs,
-                        ...ruleSuggestionsOf(creq.toolName, presentedArgs),
-                        message: first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
-                        ...askSourceIdentity(),
-                        ...riskAxesOf(creq.toolName),
-                        ...(first.action === "ask" && first.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                    }, pc.onAsk, csignal ?? abortController.signal);
-                    const askWaitMs = Math.max(0, now() - askT0);
-                    if (resolved.action === "deny" && resolved.approverUnavailable === true) {
-                        if (markInheritedUnavailable(creq.toolCallId))
+                        if (first.action === "deny")
+                            return first;
+                        if (first.action === "allow")
+                            return { action: "allow" };
+                        if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
                             return first;
-                        return {
-                            action: "deny",
-                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
-                        };
-                    }
-                    if (resolved.action !== "allow")
-                        return resolved;
-                    if (resolved.updatedInput !== undefined) {
-                        return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal);
-                    }
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
-                    return { action: "allow" };
-                },
-            }
-            : {
-                check: async (creq, csignal) => {
-                    let decision;
-                    try {
-                        decision = await pc.policy.check(creq, csignal ?? abortController.signal);
-                    }
-                    catch (err) {
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
-                        };
-                    }
-                    if (decision.action !== "ask")
-                        return decision;
-                    if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
-                        return decision;
-                    }
-                    if (pc.durableMandate === true) {
-                        if (resolveCheckpointStore(spec, deps) !== undefined &&
-                            (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
-                            markInheritedUnavailable(creq.toolCallId)) {
-                            return decision;
                         }
-                        return {
-                            action: "deny",
-                            message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
-                                `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
-                        };
-                    }
-                    const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
-                    const askT0 = now();
-                    const resolved = await resolveAsk({
-                        toolName: creq.toolName,
-                        toolCallId: creq.toolCallId,
-                        args: presentedArgs,
-                        ...ruleSuggestionsOf(creq.toolName, presentedArgs),
-                        message: decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
-                        ...askSourceIdentity(),
-                        ...riskAxesOf(creq.toolName),
-                        ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
-                    }, pc.onAsk, csignal ?? abortController.signal);
-                    const askWaitMs = Math.max(0, now() - askT0);
-                    if (resolved.action === "deny" && resolved.approverUnavailable === true) {
-                        if (markInheritedUnavailable(creq.toolCallId))
+                        if (pc.durableMandate === true) {
+                            if (resolveCheckpointStore(spec, deps) !== undefined &&
+                                (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
+                                markInheritedUnavailable(creq.toolCallId)) {
+                                return first;
+                            }
+                            return {
+                                action: "deny",
+                                message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                                    `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
+                            };
+                        }
+                        const presentedArgs = creq.args;
+                        const askT0 = now();
+                        const resolved = await resolveAsk({
+                            toolName: creq.toolName,
+                            toolCallId: creq.toolCallId,
+                            args: presentedArgs,
+                            ...ruleSuggestionsOf(creq.toolName, presentedArgs),
+                            message: first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                            ...askSourceIdentity(),
+                            ...riskAxesOf(creq.toolName),
+                            ...(first.action === "ask" && first.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                        }, pc.onAsk, csignal ?? abortController.signal);
+                        const askWaitMs = Math.max(0, now() - askT0);
+                        if (resolved.action === "deny" && resolved.approverUnavailable === true) {
+                            if (markInheritedUnavailable(creq.toolCallId))
+                                return first;
+                            return {
+                                action: "deny",
+                                message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
+                            };
+                        }
+                        if (resolved.action !== "allow")
+                            return resolved;
+                        if (resolved.updatedInput !== undefined) {
+                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal);
+                        }
+                        recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
+                        return { action: "allow" };
+                    },
+                }
+                : {
+                    check: async (creq, csignal) => {
+                        let decision;
+                        try {
+                            decision = await pc.policy.check(creq, csignal ?? abortController.signal);
+                        }
+                        catch (err) {
+                            return {
+                                action: "deny",
+                                message: `inherited parent policy errored for "${creq.toolName}": ${err instanceof Error ? err.message : String(err)}`,
+                            };
+                        }
+                        if (decision.action !== "ask")
                             return decision;
-                        return {
-                            action: "deny",
-                            message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
-                        };
-                    }
-                    if (resolved.action !== "allow")
-                        return resolved;
-                    if (resolved.updatedInput !== undefined) {
-                        return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal);
-                    }
-                    recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
-                    return decision.updatedInput !== undefined ? { ...resolved, updatedInput: decision.updatedInput } : resolved;
-                },
-            });
+                        if (creq.toolName === ASK_USER_QUESTION_TOOL_NAME && (pc.durableMandate !== true || markInheritedUnavailable(creq.toolCallId))) {
+                            return decision;
+                        }
+                        if (pc.durableMandate === true) {
+                            if (resolveCheckpointStore(spec, deps) !== undefined &&
+                                (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) &&
+                                markInheritedUnavailable(creq.toolCallId)) {
+                                return decision;
+                            }
+                            return {
+                                action: "deny",
+                                message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ` +
+                                    `ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,
+                            };
+                        }
+                        const presentedArgs = decision.updatedInput !== undefined ? decision.updatedInput : creq.args;
+                        const askT0 = now();
+                        const resolved = await resolveAsk({
+                            toolName: creq.toolName,
+                            toolCallId: creq.toolCallId,
+                            args: presentedArgs,
+                            ...ruleSuggestionsOf(creq.toolName, presentedArgs),
+                            message: decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
+                            ...askSourceIdentity(),
+                            ...riskAxesOf(creq.toolName),
+                            ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                        }, pc.onAsk, csignal ?? abortController.signal);
+                        const askWaitMs = Math.max(0, now() - askT0);
+                        if (resolved.action === "deny" && resolved.approverUnavailable === true) {
+                            if (markInheritedUnavailable(creq.toolCallId))
+                                return decision;
+                            return {
+                                action: "deny",
+                                message: `no approver is reachable for the inherited approval of "${creq.toolName}" and the marker channel is at capacity — denied fail-closed`,
+                            };
+                        }
+                        if (resolved.action !== "allow")
+                            return resolved;
+                        if (resolved.updatedInput !== undefined) {
+                            return recheckApprovedEdit(pc.policy, pc.onAsk, creq, resolved.updatedInput, csignal);
+                        }
+                        if (pc.preToolUse === undefined) {
+                            recordInheritedAskGrant(creq.toolCallId, pc.onAsk, resolved.presentedInput, askWaitMs);
+                        }
+                        return decision.updatedInput !== undefined ? { ...resolved, updatedInput: decision.updatedInput } : resolved;
+                    },
+                });
         const rewriteCapableLayers = policy !== undefined || parentConstraintWrappers.length > 0;
         const rewriteEmitterIndex = new Map();
         const rewriteCapableChain = [
@@ -3269,7 +3322,6 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 },
             }
             : foldedPolicy;
-        const hooks = spec.hooks ?? deps.hooks;
         const onAsk = spec.onAsk ?? deps.onAsk;
         const handWriteTools = handsEnabled && spec.handsReadOnly !== true
             ? Object.keys(HAND_TOOL_EFFECTS).filter((name) => {
@@ -3277,7 +3329,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return eff === "write" || eff === "idempotent";
             })
             : [];
-        const hasEffectAwareGate = Boolean(policyLayers.length > 0 || hooks?.preToolUse);
+        const hasEffectAwareGate = Boolean(policyLayers.length > 0 || (hooks?.preToolUse !== undefined && !preToolUseObservational));
         const destructiveMcpUngated = mcp.tools.some((t) => !irreversibleTools.has(t.name) && !egressTools.has(t.name) && (toolEffects.get(t.name) ?? "write") !== "read");
         const firstPartyWriteUngated = (spec.tools ?? [])
             .map((t) => t.name)
@@ -3391,7 +3443,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const hookEnvFace = hookContextConsumerWired && (ownedEnv ?? deps.executionEnv) != null ? createHookEnvCapabilities(executionEnv) : undefined;
         if (effectivePolicy || hooks?.preToolUse || egressTools.size > 0 || irreversibleTools.size > 0 || resourceSuspendEligible || platformSuspendArmed || spec.enablePlanMode === true) {
             const adjudicate = effectivePolicy
-                ? (req) => raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot }, abortController.signal)), abortController.signal, () => ({
+                ? (req) => raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}) }, abortController.signal)), abortController.signal, () => ({
                     action: "deny",
                     message: "policy check aborted (task timed out or cancelled)",
                 }))
@@ -3531,6 +3583,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 carried.spentMicroUsd = prior + parkedSpendMicroUsd;
                 return carried;
             };
+            const screeningParkDisclosedRef = { done: false };
             const serializeCheckpointState = (workspaceHandle, parkedSpendMicroUsd) => ({
                 activeTools: [...activeTools],
                 outputRef: { value: outputRef.value, set: outputRef.set },
@@ -3587,6 +3640,22 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     await memoryEngineSession.harvest("checkpoint");
                 try {
                     await checkpointStore.put(token, cp);
+                    const committedCount = cp.state.inheritedGate?.parentConstraintCount;
+                    if (cp.state.inheritedGate?.requiresParentConstraint === true &&
+                        !screeningParkDisclosedRef.done &&
+                        (inheritedParentConstraints ?? []).some((pc) => pc.preToolUse !== undefined)) {
+                        screeningParkDisclosedRef.done = true;
+                        try {
+                            deps.onError?.(new Error(`durable park under an inherited PreToolUse SCREENING constraint: this checkpoint records ` +
+                                `requiresParentConstraint with parentConstraintCount=${committedCount ?? "(unrecorded)"}, and the live ` +
+                                `closures cannot be persisted. A resume on THIS Runner re-supplies them automatically; a resume on a fresh ` +
+                                `Runner (restart / another replica) must hand back the whole chain via resumeStream(..., internals), ` +
+                                `rebuilding the screening entry with createPreToolUseConstraintPolicy(hook, env) — otherwise the row stays ` +
+                                `pending. If the face only observes, declare Hooks.preToolUseObservational and it stops entering the chain.`), { phase: "degraded", sessionId, classification: "screening-constraint-in-durable-chain" });
+                        }
+                        catch {
+                        }
+                    }
                     return { ok: true };
                 }
                 catch (putErr) {
@@ -3918,7 +3987,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             if (!presented.ok) {
                                 throw new ParkRefusal(`the stored form of "${req.toolName}"'s arguments could not be presented for re-adjudication (${describeThrown(presented.cause)})`, { cause: presented.cause });
                             }
-                            const reprojected = refuseOutOfContractDecision(await basePolicyForResumeEdit.check({ toolName: req.toolName, args: presented.value, toolCallId: req.toolCallId }, abortController.signal));
+                            const reprojected = refuseOutOfContractDecision(await basePolicyForResumeEdit.check({
+                                toolName: req.toolName,
+                                args: presented.value,
+                                toolCallId: req.toolCallId,
+                                ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}),
+                            }, abortController.signal));
                             const demanded = reprojected.updatedInput !== undefined ? tryCloneArgs(reprojected.updatedInput) : undefined;
                             const rewroteTheFiledValue = reprojected.updatedInput !== undefined &&
                                 !(demanded?.ok === true &&
@@ -4114,7 +4188,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         result = await runToolGate({
                             onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: spec.taskId ?? sessionId, site: f.site, message: f.error.message, ts: Date.now() })),
                             event: e,
-                            preToolUse: hooks?.preToolUse,
+                            preToolUse: ownGatePreToolUse,
                             ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
                             adjudicate,
                             resolveAsk: resolveAskBound,

package/dist/core/runner/runtask.js

@@ -1357,6 +1357,7 @@ export class Runner {
         const hooks = h
             ? {
                 ...(typeof h.preToolUse === "function" ? { preToolUse: (t, i, c) => h.preToolUse(t, i, c) } : {}),
+                ...(typeof h.preToolUse === "function" && h.preToolUseObservational === true ? { preToolUseObservational: true } : {}),
                 ...(typeof h.postToolUse === "function" ? { postToolUse: (t, i, o, c) => h.postToolUse(t, i, o, c) } : {}),
                 ...(typeof h.userPromptSubmit === "function" ? { userPromptSubmit: (p) => h.userPromptSubmit(p) } : {}),
                 ...(typeof h.stop === "function" ? { stop: (c) => h.stop(c) } : {}),
@@ -3853,7 +3854,12 @@ export class Runner {
             throw new CheckpointError("checkpoint.invalid_outcome", `pending action reached the resolver with decision "${String(outcome.decision)}" — only "allow" executes and only "deny" injects a denial; refusing to execute`);
         }
         if (outcome.decision === "allow" && outcome.updatedInput !== undefined && prepared.basePolicyForResumeEdit) {
-            const rechecked = refuseOutOfContractDecision(await prepared.basePolicyForResumeEdit.check({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId }, prepared.abortController.signal));
+            const rechecked = refuseOutOfContractDecision(await prepared.basePolicyForResumeEdit.check({
+                toolName: pendingAction.toolName,
+                args: resolvedArgs,
+                toolCallId: pendingAction.toolCallId,
+                ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}),
+            }, prepared.abortController.signal));
             if (rechecked.action === "deny") {
                 const editedDenial = formatHookFeedback(`The approver EDITED this call's input; the edited call is denied by the deployment's tool policy and was not executed${rechecked.message ? `: ${rechecked.message}` : ""}.`);
                 emitEnd(true, { content: editedDenial });
@@ -3863,7 +3869,12 @@ export class Runner {
             }
         }
         if (prepared.denyNarrowingPolicy) {
-            const narrowed = refuseOutOfContractDecision(await prepared.denyNarrowingPolicy.check({ toolName: pendingAction.toolName, args: resolvedArgs, toolCallId: pendingAction.toolCallId }, prepared.abortController.signal));
+            const narrowed = refuseOutOfContractDecision(await prepared.denyNarrowingPolicy.check({
+                toolName: pendingAction.toolName,
+                args: resolvedArgs,
+                toolCallId: pendingAction.toolCallId,
+                ...(prepared.cwdRef !== undefined ? { cwd: prepared.cwdRef.current } : {}),
+            }, prepared.abortController.signal));
             if (narrowed.action === "deny") {
                 const narrowedDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" is now denied by a session rule and was not executed${narrowed.message ? `: ${narrowed.message}` : ""}.`);
                 emitEnd(true, { content: narrowedDenial });
@@ -4074,14 +4085,28 @@ function startTimeout(harness, abortController, remainingMs, softSuspendable = f
     if (remainingMs !== undefined) {
         const hardMs = Math.max(0, remainingMs + (softSuspendable ? WALLTIME_SUSPEND_GRACE_SEC * 1000 : 0));
         const scheduledAtMs = Date.now() + hardMs;
-        const timer = setTimeout(() => {
+        let leftMs = hardMs;
+        let timer;
+        const armChunk = () => {
+            const chunk = Math.max(0, Math.min(leftMs, MAX_TIMER_DELAY_MS));
+            timer = setTimeout(() => {
+                leftMs -= chunk;
+                if (leftMs > 0) {
+                    armChunk();
+                    return;
+                }
+                fireHardAbort();
+            }, chunk);
+        };
+        const fireHardAbort = () => {
             if (state.fired)
                 return;
             state.fired = true;
             state.latenessMs = Math.max(0, Date.now() - scheduledAtMs);
             abortController.abort();
             void harness.abort();
-        }, hardMs);
+        };
+        armChunk();
         state.clear = () => clearTimeout(timer);
     }
     return state;

package/dist/core/runner/session-rule-policy.js

@@ -58,7 +58,7 @@ export function createSessionRulePolicy(rules, opts) {
                     if (typeof path !== "string" || path.length === 0) {
                         return deny(`write tool "${req.toolName}" denied: session rule confines writes to allowDirs but the call has no resolvable path`);
                     }
-                    const canon = await canonicalizeTarget(env, path, signal, rootPath);
+                    const canon = await canonicalizeTarget(env, path, signal, req.cwd ?? rootPath);
                     if (!canon.ok) {
                         return deny(`write to "${path}" denied: its real target could not be resolved against the session-rule allowDirs`);
                     }

package/dist/core/sensitive-path-policy.js

@@ -64,7 +64,7 @@ export function createSensitivePathPolicy(opts) {
             const path = writeTargetPath(canonical, req.args);
             if (typeof path !== "string" || path.length === 0)
                 return { action: "allow" };
-            const canon = await canonicalizeTarget(opts.env, path, signal, opts.rootPath);
+            const canon = await canonicalizeTarget(opts.env, path, signal, req.cwd ?? opts.rootPath);
             if (!canon.ok) {
                 if (canon.unresolvedSymlink) {
                     return {

package/dist/core/task-registry-agent.js

@@ -1,4 +1,5 @@
 import { randomBytes } from "node:crypto";
+import { assertRetentionPolicy } from "./retention-policy.js";
 import { uuidv7 } from "../internal/harness.js";
 import { canAccessAgentRecord, BackgroundAgentStoreError, clearRevivedRowTerminalPayload, REVIVED_ROW_CLEARED_FIELDS, STALE_RUNNING_REAP_ATTRIBUTION, } from "./background-agent-store.js";
 import { shutdownDebug } from "./shutdown-debug.js";
@@ -163,6 +164,7 @@ export function endDurableClaimLane(core, id) {
     core.claimingHandles.delete(id);
 }
 export async function reapDurableAgentsLane(core, scope, deps, policy) {
+    assertRetentionPolicy("reapDurableAgents", policy);
     const now = policy.now ?? Date.now();
     if (policy.staleRunningMaxAgeMs !== undefined) {
         await deps.store.reap(scope, now, { staleRunningMaxAgeMs: policy.staleRunningMaxAgeMs });

package/dist/core/tool-policy.d.ts

@@ -2,6 +2,7 @@ export interface ToolCallRequest {
     toolName: string;
     args: unknown;
     toolCallId: string;
+    cwd?: string;
     budget?: {
         resourceRemainingMicroUsd?: number;
         resourceSpentMicroUsd: number;

package/dist/core/tool-policy.js

@@ -1,10 +1,10 @@
 import { homedir } from "node:os";
-import { isAbsolute, join, normalize as normalizePath, sep } from "node:path";
+import { join, normalize as normalizePath, posix as posixPath, sep, win32 as winPath } from "node:path";
 import { BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName } from "../tools/fs/index.js";
 import { boundInputHashOf } from "./canonical-json.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { parsePermissionRule } from "./permission-rules.js";
-import { writeTargetPath } from "../tools/fs/safety.js";
+import { isAbsolutePathForm, isWinFormPath, writeTargetPath } from "../tools/fs/safety.js";
 export const APPROVAL_SETTLED_BY_VALUES = ["human", "timeout", "aborted"];
 export function isApprovalSettledBy(v) {
     return typeof v === "string" && APPROVAL_SETTLED_BY_VALUES.includes(v);
@@ -117,6 +117,9 @@ export function createApprovalPolicy(opts) {
     if (opts.approvalTimeoutMs !== undefined && !Number.isFinite(opts.approvalTimeoutMs)) {
         throw new Error(`createApprovalPolicy: approvalTimeoutMs must be a finite number of ms (got ${opts.approvalTimeoutMs}) — omit it to wait indefinitely`);
     }
+    if (opts.approvalTimeoutMs !== undefined && opts.approvalTimeoutMs > 2_147_483_647) {
+        throw new Error(`createApprovalPolicy: approvalTimeoutMs must not exceed 2147483647ms (~24.8 days) (got ${opts.approvalTimeoutMs}) — a host timer truncates a larger delay and fires immediately, denying every request at once; omit it to wait indefinitely`);
+    }
     const need = new Set(opts.requireApproval);
     const deny = new Set(opts.deny ?? []);
     const auto = new Set(opts.autoAllow ?? []);
@@ -526,13 +529,16 @@ export function createTranscriptIntegrityPolicy(opts) {
     const readAllow = new Set(opts?.readAllow ?? BASH_READONLY_DEFAULT_ALLOW);
     const shellTools = canonicalToolNameSet(opts?.tools);
     const dirSegs = dirs.map((d) => pathSegments(d).map(foldPathCase));
-    const inProtectedDir = (p) => {
-        const abs = lexicalPath(p, home);
+    const inProtectedDir = (p, liveCwd) => {
+        const rawRelative = !isAbsolutePathForm(p);
+        const joinInFamily = (base, rel) => isWinFormPath(base) ? winPath.join(base, rel) : posixPath.join(base, rel);
+        const abs = liveCwd !== undefined && rawRelative ? lexicalPath(joinInFamily(liveCwd, p), home) : lexicalPath(p, home);
         const segs = pathSegments(abs).map(foldPathCase);
-        if (isAbsolute(abs)) {
-            return dirSegs.some((d) => d.length <= segs.length && d.every((s, i) => s === segs[i]));
-        }
-        return dirSegs.some((d) => relativeContinuesDirTail(segs, d));
+        if (isAbsolutePathForm(abs) && dirSegs.some((d) => d.length <= segs.length && d.every((s, i) => s === segs[i])))
+            return true;
+        if (!rawRelative)
+            return false;
+        return dirSegs.some((d) => relativeContinuesDirTail(pathSegments(lexicalPath(p, home)).map(foldPathCase), d));
     };
     const referencesProtectedDir = (cmd) => {
         const hay = foldPathCase(cmd);
@@ -571,18 +577,21 @@ export function createTranscriptIntegrityPolicy(opts) {
                 if (typeof command !== "string")
                     return ALLOW;
                 const cmd = command.normalize("NFC");
-                if (!referencesProtectedDir(cmd))
+                const cwdInsideProtected = req.cwd !== undefined && inProtectedDir(req.cwd);
+                if (!referencesProtectedDir(cmd) && !cwdInsideProtected)
                     return ALLOW;
                 const parsed = parseLeadingCommandName(command);
                 if ("name" in parsed && readAllow.has(parsed.name))
                     return ALLOW;
                 return askReason("name" in parsed
-                    ? `\`${parsed.name}\` is not a read-only command`
-                    : "the command references the transcript directory and is not a single read-only command (fail-closed)");
+                    ? `\`${parsed.name}\` is not a read-only command${cwdInsideProtected ? " and the shell's working directory is inside the transcript directory" : ""}`
+                    : cwdInsideProtected
+                        ? "the shell's working directory is inside the transcript directory and this is not a single read-only command (fail-closed)"
+                        : "the command references the transcript directory and is not a single read-only command (fail-closed)");
             }
             if (toolName === "Write" || toolName === "Edit" || toolName === "NotebookEdit") {
                 const p = writeTargetPath(toolName, req.args);
-                if (typeof p === "string" && inProtectedDir(p)) {
+                if (typeof p === "string" && inProtectedDir(p, req.cwd)) {
                     return askReason(`"${p}" is inside the session-transcript directory`);
                 }
             }

package/dist/core/workflow-run-store.js

@@ -1,3 +1,4 @@
+import { assertRetentionPolicy } from "./retention-policy.js";
 export function summarizeWorkflowRun(run) {
     const latestPhase = run.phases.at(-1);
     return {
@@ -73,6 +74,7 @@ export class InMemoryWorkflowRunStore {
         return queryWorkflowRuns(this.runs.values(), scope, opts);
     }
     async reap(scope, now, opts) {
+        assertRetentionPolicy("WorkflowRunStore.reap", opts);
         if (opts?.maxAgeMs === undefined && opts?.keep === undefined)
             return 0;
         const terminal = [...this.runs.values()].filter((r) => r.scope === scope && isTerminalWorkflowStatus(r.status));

package/dist/index.d.ts

@@ -131,7 +131,7 @@ export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmitti
 export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, } from "./core/permission-rule-store.js";
 export { prepareCardApproval, confirmRuleApproval, type ConfirmResult, type ConfirmRefusalReason, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, type RuleTicket, type RuleCandidate, type RuleApprovalKind, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleConsentDeps, type RedeemResult, type CcImportLayer, type ImportedSettingsLayer, type ImportPreview, type ImportResult, } from "./core/permission-rule-consent.js";
 export { FilePermissionRuleStoreProvider } from "./stores/file/permission-rule-store.js";
-export { formatHookFeedback, runToolGate, createHookEnvCapabilities, type Hooks, type HookToolContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
+export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type Hooks, type HookToolContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";