@sema-agent/core 5.25.0 → 5.27.0

package/dist/core/tool-result-store.js

@@ -2,6 +2,34 @@ import { createHash } from "node:crypto";
 import { Type } from "typebox";
 import { defineTool, errorResult } from "./tools.js";
 import { TOOL_SEARCH_NAME } from "./runner/tool-disclosure.js";
+export const TOOL_RESULT_REF_CONFLICT_CODE = "tool_result.ref_conflict";
+export class ToolResultRefConflictError extends Error {
+    ref;
+    stored;
+    incoming;
+    code = TOOL_RESULT_REF_CONFLICT_CODE;
+    constructor(ref, stored, incoming) {
+        super(`tool-result store: ref ${JSON.stringify(ref)} already belongs to a different origin ` +
+            `(stored ${describeProvenance(stored)}, offered ${describeProvenance(incoming)}) — refusing to store under it`);
+        this.ref = ref;
+        this.stored = stored;
+        this.incoming = incoming;
+        this.name = "ToolResultRefConflictError";
+    }
+}
+function describeProvenance(p) {
+    return p.taskId === undefined ? `session=${p.sessionId}` : `session=${p.sessionId} task=${p.taskId}`;
+}
+export function assertToolResultProvenanceMatch(ref, stored, incoming) {
+    if (stored === undefined || incoming === undefined)
+        return;
+    if (stored.sessionId === incoming.sessionId && stored.taskId === incoming.taskId)
+        return;
+    throw new ToolResultRefConflictError(ref, stored, incoming);
+}
+export function normalizeToolResultProvenance(p) {
+    return p.taskId === undefined ? { sessionId: p.sessionId } : { sessionId: p.sessionId, taskId: p.taskId };
+}
 export function assertSafeToolResultRef(ref) {
     const bad = ref === "" ||
         ref === "." ||
@@ -14,14 +42,23 @@ export function assertSafeToolResultRef(ref) {
 }
 const NATIVE_REF_CHARSET = /^[A-Za-z0-9_.-]+$/;
 const MAX_REF_SEGMENT_CHARS = 128;
-export function buildToolResultRef(sessionId, toolCallId) {
-    return `tr_${refSegment(sessionId)}_${refSegment(toolCallId)}`;
+const REF_SEGMENT_SEPARATOR = "~";
+const FOLDED_SEGMENT_PREFIX = "fold.";
+export function buildToolResultRef(sessionId, toolCallId, ...extraSegments) {
+    return [`tr_${refSegment(sessionId)}`, refSegment(toolCallId), ...extraSegments.map(refSegment)].join(REF_SEGMENT_SEPARATOR);
 }
 function refSegment(raw) {
-    if (raw.length <= MAX_REF_SEGMENT_CHARS && NATIVE_REF_CHARSET.test(raw))
+    if (raw.length <= MAX_REF_SEGMENT_CHARS && NATIVE_REF_CHARSET.test(raw) && !raw.startsWith(FOLDED_SEGMENT_PREFIX))
         return raw;
     const base = raw.replace(/[^A-Za-z0-9_.-]/g, "-").slice(0, 32);
-    return `${base || "x"}-${createHash("sha256").update(raw, "utf8").digest("hex")}`;
+    return `${FOLDED_SEGMENT_PREFIX}${base || "x"}-${digestOfString(raw)}`;
+}
+export const MAX_MINTED_TOOL_RESULT_REF_CHARS = 3 + 4 * MAX_REF_SEGMENT_CHARS + 3;
+export function toolResultContentSegment(text) {
+    return `s${digestOfString(text).slice(0, 32)}`;
+}
+function digestOfString(s) {
+    return createHash("sha256").update(Buffer.from(s, "utf16le")).digest("hex");
 }
 export class InMemoryToolResultStore {
     opts;
@@ -35,27 +72,33 @@ export class InMemoryToolResultStore {
             throw new Error("InMemoryToolResultStore: maxTotalChars must be a number (got NaN) — omit it for an unbounded store");
         }
     }
-    put(ref, content) {
+    put(ref, content, provenance) {
         assertSafeToolResultRef(ref);
-        if (this.map.has(ref))
+        const existing = this.map.get(ref);
+        if (existing !== undefined) {
+            assertToolResultProvenanceMatch(ref, existing.provenance, provenance);
             return;
-        this.map.set(ref, content);
+        }
+        this.map.set(ref, provenance === undefined ? { content } : { content, provenance: normalizeToolResultProvenance(provenance) });
         this.totalChars += content.length;
         const cap = this.opts?.maxTotalChars;
         if (cap !== undefined && Number.isFinite(cap)) {
-            for (const [oldRef, oldContent] of this.map) {
+            for (const [oldRef, oldEntry] of this.map) {
                 if (this.totalChars <= cap || oldRef === ref)
                     break;
                 this.map.delete(oldRef);
-                this.totalChars -= oldContent.length;
+                this.totalChars -= oldEntry.content.length;
             }
         }
     }
+    ownerOf(ref) {
+        return this.map.get(ref)?.provenance;
+    }
     isEmpty() {
         return this.map.size === 0;
     }
     get(ref, opts) {
-        const full = this.map.get(ref);
+        const full = this.map.get(ref)?.content;
         if (full === undefined)
             return undefined;
         const offset = Math.min(full.length, Math.max(0, intOr(opts?.offset, 0)));
@@ -77,21 +120,32 @@ export class ScopedToolResultStore {
         this.volatileBacking = inner instanceof InMemoryToolResultStore;
     }
     key(ref) {
-        const scope = encodeURIComponent(this.scope);
+        const scope = encodeScopeSegment(this.scope);
         return `${scope.length}:${scope}:${ref}`;
     }
-    put(ref, content) {
+    put(ref, content, provenance) {
         assertSafeToolResultRef(ref);
         this.localPuts++;
-        return this.inner.put(this.key(ref), content);
+        return this.inner.put(this.key(ref), content, provenance);
     }
     get(ref, opts) {
         return this.inner.get(this.key(ref), opts);
     }
+    ownerOf(ref) {
+        return this.inner.ownerOf?.(this.key(ref));
+    }
     isEmpty() {
         return this.localPuts === 0;
     }
 }
+function encodeScopeSegment(scope) {
+    let out = "";
+    for (let i = 0; i < scope.length; i++) {
+        const ch = scope[i];
+        out += /[A-Za-z0-9]/.test(ch) ? ch : `%${ch.charCodeAt(0).toString(16).padStart(4, "0")}`;
+    }
+    return out;
+}
 export function isVolatileOffloadStore(store) {
     if (store instanceof ScopedToolResultStore)
         return store.volatileBacking;
@@ -99,15 +153,19 @@ export function isVolatileOffloadStore(store) {
 }
 export const OFFLOAD_TOOL_NAME = "ReadToolResult";
 export function createOffloadPersist(store, sessionId) {
+    const provenance = toolResultProvenanceOf(sessionId);
     return (toolCallId, fullText) => {
-        const ref = buildToolResultRef(sessionId, toolCallId);
-        void Promise.resolve(store.put(ref, fullText)).catch((err) => {
+        const ref = buildToolResultRef(sessionId, toolCallId, toolResultContentSegment(fullText));
+        void Promise.resolve(store.put(ref, fullText, provenance)).catch((err) => {
             const cause = err instanceof Error ? err.message : String(err);
-            void Promise.resolve(store.put(ref, `[offload LOST at write time: ${cause} — the inline preview is all that survived]`)).catch(() => undefined);
+            void Promise.resolve(store.put(ref, `[offload LOST at write time: ${cause} — the inline preview is all that survived]`, provenance)).catch(() => undefined);
         });
         return ref;
     };
 }
+export function toolResultProvenanceOf(sessionId, taskId) {
+    return taskId === undefined ? { sessionId } : { sessionId, taskId };
+}
 export function offloadPagebackHint(ref, form, reachableTools) {
     const activate = reachableTools !== undefined && !reachableTools.has(OFFLOAD_TOOL_NAME)
         ? `${OFFLOAD_TOOL_NAME} is not active yet — call ${TOOL_SEARCH_NAME} with {"query":"select:${OFFLOAD_TOOL_NAME}"} to activate it, then `
@@ -164,9 +222,10 @@ export function buildPreview(full, ref, sizes, reachableTools) {
 export function withToolResultOffload(tool, store, thresholdChars, sessionId, reachableTools) {
     if (!(Number.isFinite(thresholdChars) && thresholdChars > 0))
         return tool;
+    const provenance = toolResultProvenanceOf(sessionId);
     const wrappedExecute = async (toolCallId, params, signal, onUpdate) => {
         const res = await tool.execute(toolCallId, params, signal, onUpdate);
-        const offloadedDetails = res.details === undefined ? undefined : await offloadOversizedDetailStrings(res.details, store, thresholdChars, sessionId, toolCallId);
+        const offloadedDetails = res.details === undefined ? undefined : await offloadOversizedDetailStrings(res.details, store, thresholdChars, sessionId, toolCallId, provenance);
         const withDetails = (r) => offloadedDetails === undefined || offloadedDetails.value === res.details ? r : { ...r, details: offloadedDetails.value };
         if (totalTextChars(res.content) <= thresholdChars)
             return withDetails(res);
@@ -176,20 +235,20 @@ export function withToolResultOffload(tool, store, thresholdChars, sessionId, re
             .join("\n");
         if (full.length <= PREVIEW_HEAD_CHARS + PREVIEW_TAIL_CHARS)
             return withDetails(res);
-        const ref = buildToolResultRef(sessionId, toolCallId);
-        await store.put(ref, full);
+        const ref = buildToolResultRef(sessionId, toolCallId, toolResultContentSegment(full));
+        await store.put(ref, full, provenance);
         const images = res.content.filter((b) => b.type !== "text");
         return withDetails({ ...res, content: [{ type: "text", text: buildPreview(full, ref, undefined, reachableTools?.()) }, ...images] });
     };
     return { ...tool, execute: wrappedExecute };
 }
 const OFFLOADED_DETAIL_HEAD_CHARS = 2_000;
-const OFFLOADED_DETAIL_NOTICE_ALLOWANCE_CHARS = 400;
+const OFFLOADED_DETAIL_NOTICE_ALLOWANCE_CHARS = MAX_MINTED_TOOL_RESULT_REF_CHARS + 200;
 export const OFFLOADED_DETAIL_NOTICE_PREFIX = "…[offloaded — ";
 export function isOffloadedDetailReplacement(s) {
     return s.includes(`\n${OFFLOADED_DETAIL_NOTICE_PREFIX}`);
 }
-async function offloadOversizedDetailStrings(details, store, thresholdChars, sessionId, toolCallId) {
+async function offloadOversizedDetailStrings(details, store, thresholdChars, sessionId, toolCallId, provenance) {
     const puts = [];
     const onStack = new Set();
     const isPlainObject = (v) => {
@@ -199,8 +258,8 @@ async function offloadOversizedDetailStrings(details, store, thresholdChars, ses
         return p === Object.prototype || p === null;
     };
     const replace = (full, path) => {
-        const detailRef = buildToolResultRef(sessionId, toolCallId + " " + path);
-        puts.push(Promise.resolve(store.put(detailRef, full)));
+        const detailRef = buildToolResultRef(sessionId, toolCallId, path, toolResultContentSegment(full));
+        puts.push(Promise.resolve(store.put(detailRef, full, provenance)));
         return (`${full.slice(0, OFFLOADED_DETAIL_HEAD_CHARS)}\n` +
             `${OFFLOADED_DETAIL_NOTICE_PREFIX}${full.length} chars total; ref "${detailRef}"; the remainder is retained in this run's tool-result store and reads back through the deployment's tool-results face]`);
     };

package/dist/core/types.d.ts

@@ -320,6 +320,12 @@ export interface ToolSpec<TParams extends TSchema = TSchema> {
      * text under `"static"`, where the placeholder is never swapped. Use for large/MCP tool sets where
      * inlining hundreds of schemas blows up turn-1 tokens and risks prefix-cache breakage. Default: not
      * deferred (full schema inlined). See {@link RunnerDeps.deferMode}.
+     *
+     * SCOPE: this flag reaches the classifier through CALLER specs (`TaskSpec.tools`) only — a
+     * built-in/injected tool's spec never enters that list, so setting `defer` on a spec that shadows a
+     * built-in name does nothing. To defer an already-mounted tool (built-ins included), list its wire
+     * name in {@link TaskSpec.deferTools}. Also inert when the tool ends up excluded (exclusion wins)
+     * or pinned ({@link alwaysLoad} / {@link TaskSpec.alwaysLoadTools}).
      */
     defer?: boolean;
     /**
@@ -705,6 +711,17 @@ export interface ToolExecuteContext {
      *  is a DEPLOYMENT property, not a per-task one — a child in the same sandbox needs the same facts
      *  (its env block renders the scratchpad section; its root fence admits the scratchpad dir). */
     envFacts?: TaskSpec["envFacts"];
+    /**
+     * The parent task's DECLARED {@link TaskSpec.memoryPersistenceCapable} — present ONLY when the spec
+     * set it (an inferred run's ctx gains no key), Runner-filled on the same trusted seat as
+     * {@link principal}: never a model/tool argument. A delegation tool (`createSubagentTool`) forwards
+     * it into every child spec it builds so the deployment's persistence statement survives delegation:
+     * `false` is a floor a chosen agent definition cannot loosen (the read-only-memory disclosure must
+     * hold tree-wide when the deployment says nothing durable is reachable), `true` is a default a
+     * definition may narrow back to `false`. Absent ⇒ nothing is forwarded and each child's own roster
+     * inference decides, exactly as before the seat existed.
+     */
+    memoryPersistenceCapable?: boolean;
     /**
      * [893]④a — the parent task's per-model auth hook ({@link TaskSpec.getApiKeyAndHeaders}), inherited
      * verbatim down the delegation tree like `principal`/`clientContext` (Runner-filled, read-only, NEVER
@@ -838,8 +855,11 @@ export interface ToolExecuteContext {
      * `RunInternals.onForwardEvent`) to receive a SUBAGENT's live `task_progress` ticks that otherwise stay in the
      * child's ISOLATED stream. A delegation tool threads it to the child so nested progress bubbles to one sink. This
      * is a DISPLAY channel ONLY — the child stream is NEVER merged into the parent's MODEL context, and nothing
-     * security-relevant consumes a forwarded event. Present ONLY when the deployment opted in; the Runner filters it
-     * to `task_progress` (a tool cannot push other event types). ⚠️ Forwarded ticks are UNTRUSTED display hints — any
+     * security-relevant consumes a forwarded event. Present ONLY when the deployment opted in. The tool-ctx wrapper
+     * passes `task_progress` unconditionally and — when the deployment sets `forwardSubagentEvents: true` — the
+     * transcript classes too (text_delta/reasoning_delta/tool_start/tool_end); other event types never cross it.
+     * The delegation lane's OWN tap is trusted and forwards the child's FULL event stream (bg frames tagged
+     * with bgAgentId). ⚠️ Forwarded ticks are UNTRUSTED display hints — any
      * tool holding this ctx could forge one, so a consumer validates `parentTaskId` against its known runs.
      */
     forwardEvent?: (event: TaskEvent) => void;
@@ -1058,6 +1078,19 @@ export interface AgentDefinition {
     maxTurns?: number;
     /** Long-term memory scope for this agent (same shape as {@link TaskSpec.memory}). */
     memory?: TaskSpec["memory"];
+    /**
+     * This agent's own {@link TaskSpec.memoryPersistenceCapable} declaration — the same three-state
+     * statement, made per definition: an agent whose closure tools persist memory declares `true`
+     * (suppressing the read-only-memory disclosure no roster inference can clear), one whose roster
+     * looks write-capable but reaches no durable store declares `false` (forcing the disclosure).
+     * Arbitration with the spawning run's declaration: a parent's explicit `false` is a FLOOR and wins
+     * over a definition `true` (the disclosure is about the deployment's storage, which choosing this
+     * agent does not change); otherwise a declared definition value wins over the parent's; absent
+     * both, the child spec carries no value and the child's own roster inference decides.
+     * On the workflow lane (`agent(…, {agentType})`) the definition value fills an ABSENT governed-spec
+     * value only — a base/spec declaration of either polarity wins (the lane's spec-pinned-fields rule).
+     */
+    memoryPersistenceCapable?: boolean;
     /**
      * Observer agents (CC 2.1.206 parity — 逐字锚 docs/CC206-OBSERVER-ANCHORS-2026-07-11.md, schema
      * 面 C @28385708): "Agent type auto-spawned as a background observer whenever this agent runs.
@@ -1841,7 +1874,9 @@ export interface TaskSpec {
      * write-capable fs tools (CC's same gate); zero cost/behavior change otherwise. `false` opts out.
      */
     lspDiagnostics?: boolean;
-    /** In-process hooks (PreToolUse/PostToolUse/UserPromptSubmit) for this task. Overrides `RunnerDeps.hooks`. */
+    /** In-process hooks for this task — the full `Hooks` lifecycle seam (tool pre/post/failure/batch
+     *  interception, prompt gating, stop pushback, compaction taps, permission-denied observation; each
+     *  member's contract is on the interface). Overrides `RunnerDeps.hooks`. */
     hooks?: import("./hooks.js").Hooks;
     /**
      * design/45 **durable suspend-on-approval** (F4). When set AND a `CheckpointStore` is wired
@@ -2016,6 +2051,39 @@ export interface TaskSpec {
      * modify the project. No effect unless an `executionEnv` is injected. Default false.
      */
     handsReadOnly?: boolean;
+    /**
+     * Whether this run can persist a user's "remember X" somewhere durable — the deployment's own
+     * statement, overriding the runner's inference. The runner mounts a read-only-memory disclosure
+     * (the model must decline to "remember" instead of receipting a save that never happens) when the
+     * session provably cannot persist; provability is inferred from KNOWN store paths only (a mounted
+     * file-write tool or a write-capable shell). A caller tool that persists through its own closure
+     * (a custom memory writer) is invisible to that inference and would be contradicted by the
+     * disclosure — set `true` to declare the channel and suppress it. Set `false` to force the
+     * disclosure even when write-capable tools mount (e.g. they cannot reach any durable store);
+     * a forced `false` also replaces the `# Memory` write instruction itself and drops the
+     * preference-writing discipline and index seed that serve it.
+     * Default: inferred. The inference also treats a REMOTE execution env's hand band as unable to
+     * reach the host-side memory root (sandbox filesystem); a deployment whose remote env shares a
+     * mount with the memory root declares `true` — on such a remote, `true` also restores the
+     * `# Memory` write instruction when a Write tool mounts (a declared-capable session must be told
+     * the path, not left silent). If your persistence channel is NOT the file face, do not mount a
+     * tool named `Write` alongside the declaration, or keep the default and teach your own channel.
+     * Delegation: a DECLARED value crosses the delegation boundary (sync / background / fork spawns and
+     * the retained-resume snapshot alike). An explicit `false` is a FLOOR — a chosen
+     * {@link AgentDefinition.memoryPersistenceCapable} `true` cannot loosen it (the disclosure is
+     * about the deployment's storage, which no agent selection changes); an explicit `true` is a
+     * DEFAULT the chosen definition may narrow back to `false`; absent = absent downstream too — each
+     * child runs its own inference over its own roster. A retained child woken by a DIFFERENT run
+     * additionally folds the waker's declared `false` on top of the spawn snapshot (tighten-only,
+     * like the other resume clamps).
+     * KNOWN GAPS (registered, whole-clamp-family shapes — `handsReadOnly`/`interactiveTools` share
+     * them): a TIER-3 durable revival rebuilds the child from the REVIVER's context (the durable row
+     * records lookup keys, never a serialized spec), so the spawn-time declaration does not survive
+     * that lane — the reviver's own declaration governs; and the workflow HOST lane does not forward
+     * the host TaskSpec's declaration into `agent()` children (an {@link AgentDefinition} on the
+     * workflow agent type does carry).
+     */
+    memoryPersistenceCapable?: boolean;
     /**
      * design/119 (CC --add-dir parity): extra directories the FILE tools may access in addition to the
      * containment root — each is canonicalized into the containment allowlist and listed in the
@@ -2090,6 +2158,11 @@ export interface TaskSpec {
      *    (writes, egress, pipes, unknown commands) tightens to ask. An egress command (e.g. `curl`) suspends under
      *    the IRREVERSIBLE axis (the shell mark is irreversibility, not egress) — the kind is non-budgetable either
      *    way, so the budget resolver still never auto-approves it; the axis label is informational.
+     *    NOT unconditional: a POSITIVE per-tool mark on the shell tool keeps its seat — an explicit
+     *    `irreversibility:"always"` is never downgraded (the tier combine is tighten-only) and an explicit
+     *    `"maybe"` keeps its own probe (a probe-less explicit `"maybe"` stays fail-closed ask; the doctrine's
+     *    generic probe installs only on doctrine-owned seats). An explicit `"never"` is NOT a mark — the
+     *    doctrine governs that seat as if unmarked.
      * No effect under `handsReadOnly` (that mounts `bash_readonly`, already allowlisted) or with no execution env.
      * **Re-supply on resume:** like `toolPolicy`/`tools`/`durableApproval`, `shellGate` is part of the resume
      * task config — a resume that omits it leaves the resumed run's SUBSEQUENT `bash` calls ungated (the approved
@@ -4661,10 +4734,15 @@ export interface RunnerDeps {
      *  task's own `lspManager` overrides this. Unset ⇒ no `lsp` tool. */
     lspManager?: import("./lsp.js").LspServerManager;
     /**
-     * Default in-process hooks for all tasks (design/37): PreToolUse (rewrite/restrict args + inject
-     * context), PostToolUse (rewrite output + inject context), UserPromptSubmit (block/inject before the
-     * objective becomes a message). A task's own `hooks` overrides this. A PreToolUse hook's `allow`
-     * never bypasses `toolPolicy` — the policy is always the final say.
+     * Default in-process hooks for all tasks (design/37) — the FULL lifecycle seam of the `Hooks`
+     * interface, not just the tool-call trio: `preToolUse` (rewrite/restrict args + inject context),
+     * `postToolUse` (rewrite output + inject context), `userPromptSubmit` (block/inject before the
+     * objective becomes a message), plus `stop` (push back when the run would otherwise end and continue
+     * it), `postToolUseFailure` / `postToolBatch` / `permissionDenied` (failure, batch-boundary and
+     * deny observers), `preCompact` / `postCompact` (compaction gate + observer), `stopFailure`
+     * (API-error terminal observer) and the `preToolUseObservational` declaration flag — each member's
+     * contract is documented on the `Hooks` interface itself. A task's own `hooks` overrides this. A
+     * PreToolUse hook's `allow` never bypasses `toolPolicy` — the policy is always the final say.
      */
     hooks?: import("./hooks.js").Hooks;
     /**
@@ -4682,12 +4760,30 @@ export interface RunnerDeps {
      * - `"prompt-constitution"` — a `stableSystem` provider returned an ALREADY-assembled prompt
      *   (constitution anchor found); core passed it through un-doubled. Upgrade the provider to return
      *   only the role base (or set `replaceAll: true` to own the whole base).
+     * - `"degraded"` — the task kept running with a capability quietly reduced: a question auto-answered
+     *   with no human present, a skipped env git snapshot, a lost checkpoint-put confirmation, an
+     *   unroutable descendant notification, and similar best-effort arms. The run proceeds; the reduced
+     *   arm is what is being disclosed (`classification` names it).
+     * - `"config"` — a deployment-wiring problem detected while preparing or tearing down a task: tool
+     *   mount conflicts, refused/ignored knob values, gate-off notices, store/env teardown legs. The
+     *   broadest class by call-site count — most misconfigurations announce here rather than failing
+     *   the task.
      * - `"memory"` — a post-task memory-consolidation pass failed or skipped a malformed reconcile
      *   decision (design/41). Best-effort: the notes the model saved are kept; the task still succeeds.
      * - `"mcp"` — an MCP server failed to connect / list its tools and was skipped (fail-open, design/29);
      *   the task runs with the remaining servers' tools. One call per failed server.
      * - `"a2a"` — the A2A sibling of `"mcp"`: a declared peer's agent card could not be fetched/read, or it
      *   advertises no transport this client speaks, so the peer was skipped. One call per skipped peer.
+     * - `"interrupt-reconcile"` — repairing an interrupted session's transcript on re-entry (synthesizing
+     *   tool results for orphaned calls, flushing held session writes) failed; the run proceeds on the
+     *   unrepaired transcript.
+     * - `"suggestions"` — the best-effort follow-up-suggestions pass failed or timed out; the result
+     *   simply carries no suggestions.
+     * - `"rewind"` — the per-turn working-tree snapshot backing file rewind failed or was skipped (e.g. a
+     *   too-large root inside its cooldown window); turns without a snapshot cannot be rewound to.
+     * - `"hook"` — a deployment hook misbehaved: a callback threw, or returned a verdict it was not
+     *   allowed to (e.g. a declared-observational hook). The engine applies the hook's own documented
+     *   fallback (swallow, or fail-closed deny, per its contract) and reports the fact here.
      */
     onError?: (err: unknown, context: {
         phase: "compaction" | "prompt-cache" | "prompt-constitution" | "degraded" | "config" | "memory" | "mcp" | "a2a" | "interrupt-reconcile" | "suggestions" | "rewind" | "hook";

package/dist/core/untrusted-text.d.ts

@@ -170,8 +170,12 @@ export declare function defuseControlChars(text: string): string;
  * Make untrusted text safe to interpolate INLINE on a trusted prompt line (not inside a {@link delimitUntrusted}
  * fence) — e.g. design/80 D-F echoes a chosen option label into the "The user answered:" block. Folds EVERY
  * line/space separator to a single space so the text cannot forge a new line — `\s` (covers CR/LF/TAB/VT/FF and
- * U+2028/U+2029 + the Unicode spaces) PLUS U+0085 NEL, which `\s` does NOT match — caps the length, then applies
- * the same tag-neutralization (`</system-reminder>`) + fence-sentinel (`<<<`/`>>>`) defusing the fenced body gets.
+ * U+2028/U+2029 + the Unicode spaces) PLUS the whole C0 + DEL + C1 block (U+0000–U+001F, U+007F–U+009F), which
+ * `\s` does NOT fully match: the C1 half carries the 8-bit CSI/OSC/ST forms (U+009B/U+009D/U+009C) a
+ * C1-honoring terminal treats like their ESC-prefixed spellings, so leaving them through would let a
+ * 'sanitized' value repaint the trusted line it is interpolated onto (adversarial round finding) — caps the
+ * length, then applies the same tag-neutralization (`</system-reminder>`) + fence-sentinel (`<<<`/`>>>`)
+ * defusing the fenced body gets.
  * Defense-in-depth, NOT a guarantee (same posture as the rest of this module).
  */
 export declare function inlineUntrusted(text: string, maxLen?: number): string;

package/dist/core/untrusted-text.js

@@ -99,7 +99,7 @@ export function defuseControlChars(text) {
 }
 const LABEL_MAX = 160;
 export function inlineUntrusted(text, maxLen = LABEL_MAX) {
-    const oneLine = text.replace(/[\s\u0000-\u001f\u007f\u0085]+/g, " ").trim();
+    const oneLine = text.replace(/[\s\u0000-\u001f\u007f-\u009f]+/g, " ").trim();
     const cps = [...oneLine];
     const capped = cps.length > maxLen ? cps.slice(0, maxLen).join("") + "…" : oneLine;
     const out = defuseFenceMarkers(sanitizeUntrustedText(capped));

package/dist/engine/loop/types.d.ts

@@ -23,7 +23,11 @@ export type ToolExecutionMode = "sequential" | "parallel";
  * Controls how many queued user messages are injected when the agent loop reaches a queue drain point.
  *
  * - "all": drain and inject every queued message at that point.
- * - "one-at-a-time": drain and inject only the oldest queued message, leaving the rest queued for later drain points.
+ * - "one-at-a-time": drain and inject only the oldest queued message, leaving the rest queued for later
+ *   drain points. Exception: when the oldest frame is an engine note (a task-notification sidecar
+ *   payload), every consecutive engine-note frame behind it drains with it as ONE batch, stopping at
+ *   the first non-note frame (e.g. a real user steer) — N buffered completion notices are one
+ *   boundary's worth of frames, not N sequential turns.
  */
 export type QueueMode = "all" | "one-at-a-time";
 /** A single tool call content block emitted by an assistant message. */
@@ -394,8 +398,11 @@ export interface AgentLoopConfig extends SimpleStreamOptions {
 }
 /**
  * Thinking/reasoning level for models that support it.
- * Note: "xhigh" is only supported by selected model families. Use model thinking-level metadata
- * from openclaw/plugin-sdk/llm to detect support for a concrete model.
+ * Note: "xhigh" is only supported by selected model families. Per-model/per-endpoint support is
+ * declared in this package's model metadata (`src/engine/llm/types.ts`): the compat blocks'
+ * accepted-tier sets (`reasoningEffortLevels` on the OpenAI-family compats, `effortLevels` on the
+ * Anthropic Messages compat — a requested tier above the declared set clamps down rather than
+ * erroring), and `Model.thinkingLevelMap`, where `null` marks a level as unsupported.
  */
 export type ThinkingLevel = "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
 export interface BashExecutionMessage {

package/dist/engine/session/import-validate.js

@@ -3,12 +3,13 @@ import { leafIdAfterEntry } from "./storage-base.js";
 import { parseSessionTimestampMs } from "./timestamps.js";
 import { flattenableUserText, normalizeEngineSegments } from "../../core/untrusted-text.js";
 import { normalizePromptEpoch } from "../../prompt-assembly/epoch.js";
+import { MAX_MINTED_TOOL_RESULT_REF_CHARS } from "../../core/tool-result-store.js";
 import { PERSISTED_OUTPUT_REFS_MAX_ENTRIES, SKILL_RETENTION_PER_SKILL_MAX_CHARS, SKILL_RETENTION_TOTAL_MAX_CHARS, } from "../compaction/utils.js";
 const PATH_LIST_MAX_CHARS = 4096;
 const PATH_LIST_MAX_ENTRIES = 1000;
 const INVOKED_SKILLS_MAX_ENTRIES = 1000;
 const INVOKED_SKILL_NAME_MAX_CHARS = 1024;
-const PERSISTED_REF_MAX_CHARS = 256;
+const PERSISTED_REF_MAX_CHARS = MAX_MINTED_TOOL_RESULT_REF_CHARS;
 const ACTIVE_TOOL_NAME_MAX_CHARS = 1024;
 const ACTIVE_TOOLS_MAX_ENTRIES = 1000;
 export class StreamingImportValidator {

package/dist/index.d.ts

@@ -87,7 +87,7 @@ export type { InvariantKind, FunctionContract, Invariant, InvariantViolation, Ch
 export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, type BashReadonlyRootBoundary, type CompoundReadonlyVerdict, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
-export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, type ToolResultStore, type ToolResultSlice, } from "./core/tool-result-store.js";
+export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, type UsageWindow, type UsageWindowStore, type UsageWindowReading, type UsageWindowRecord, type UsageSlot, type UsageBucketRow, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
@@ -160,7 +160,7 @@ export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootA
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, type AdoptionStatus, type AdoptLocalDataRootOptions, type AdoptLocalDataRootResult, type AdoptionCarriageLeg, type AdoptionCarriageLegContext, type AdoptionConfigWitnessReceipt, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type Hooks, type HookToolContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, type SharedMemoryFixture, type SharedMemoryStoreContractHooks, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";
@@ -168,7 +168,7 @@ export { encodeSurfacedKey, buildManifestText, validateSelectedIds, composeSelec
 export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDATION_BAND, DEFAULT_CONSOLIDATION_SEARCH_LIMIT, DEFAULT_CONSOLIDATION_MAX_NOTES, DEFAULT_CONSOLIDATION_TIMEOUT_SEC, normalizeForExactMatch, type ConsolidationParams, type ConsolidationStats, type ConsolidationNote, type ConsolidationLLM, } from "./core/runner/memory-consolidation.js";
 export { consolidateScope, advanceCursorAfterInline, type ConsolidateScopeDeps, type ConsolidateScopeOptions, } from "./core/consolidate-scope.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
-export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, type EnvironmentFacts, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, type PromptBlock, analyzePromptCacheFriendliness, assertPromptCacheFriendly, type PromptProvider, type StablePromptContext, type PromptCacheReport, type PromptTextDeclaration, } from "./prompts/default.js";
+export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, type EnvironmentFacts, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, type PromptBlock, analyzePromptCacheFriendliness, assertPromptCacheFriendly, type PromptProvider, type StablePromptContext, type PromptCacheReport, type PromptTextDeclaration, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";
 export { compose, validatePack } from "./prompt-assembly/composer.js";
 export { SEMA_DEFAULT_PACK } from "./prompt-assembly/packs/sema-default.js";

package/dist/index.js

@@ -68,7 +68,7 @@ export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
 export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
-export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, } from "./core/tool-result-store.js";
+export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
@@ -123,7 +123,7 @@ export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootA
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";
@@ -131,7 +131,7 @@ export { encodeSurfacedKey, buildManifestText, validateSelectedIds, composeSelec
 export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDATION_BAND, DEFAULT_CONSOLIDATION_SEARCH_LIMIT, DEFAULT_CONSOLIDATION_MAX_NOTES, DEFAULT_CONSOLIDATION_TIMEOUT_SEC, normalizeForExactMatch, } from "./core/runner/memory-consolidation.js";
 export { consolidateScope, advanceCursorAfterInline, } from "./core/consolidate-scope.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
-export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, analyzePromptCacheFriendliness, assertPromptCacheFriendly, } from "./prompts/default.js";
+export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, harnessContext, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, defaultPromptProvider, composeSystemPrompt, composeConstitution, constitutionBlocks, analyzePromptCacheFriendliness, assertPromptCacheFriendly, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";
 export { compose, validatePack } from "./prompt-assembly/composer.js";
 export { SEMA_DEFAULT_PACK } from "./prompt-assembly/packs/sema-default.js";

package/dist/orchestration/run-workflow-tool.d.ts

@@ -229,9 +229,11 @@ export interface RunWorkflowToolDeps {
      *  has inherited this hook since [893]④a; the workflow lane never did — the governance whitelist
      *  rightly blocks SCRIPTS from setting it, but host inheritance is a different lane. */
     parentGetApiKeyAndHeaders?: import("../core/types.js").TaskSpec["getApiKeyAndHeaders"];
-    /** The HOST run's display sink (its `RunInternals.onForwardEvent`, already filtered to `task_progress`
-     *  by the runner's ctx wrapper) — threaded via `startWorkflow` into every spawned agent's trusted
-     *  internals so a workflow child's progress ticks bubble to the deployment's one sink, the same
+    /** The HOST run's display sink (its `RunInternals.onForwardEvent` behind the runner's ctx wrapper:
+     *  `task_progress` always, plus the children's content events — `text_delta`/`reasoning_delta`/
+     *  `tool_start`/`tool_end`, UNTRUSTED-RAW: the consumer must redact — when the HOST spec set
+     *  `forwardSubagentEvents: true`) — threaded via `startWorkflow` into every spawned agent's trusted
+     *  internals so a workflow child's events bubble to the deployment's one sink, the same
      *  channel a `createSubagentTool` delegation threads. Display-only; absent ⇒ ticks stay in each
      *  child's own stream. (A dep, not read off the execute ctx: the mounted tool's `AgentTool.execute`
      *  wrapper builds a minimal `{toolCallId, signal}` ctx — the rich-ctx injection only wraps

package/dist/orchestration/workflow.d.ts

@@ -31,8 +31,9 @@ export declare const WORKFLOW_SUBAGENT_APPEND_SCHEMA = "---\n\nNOTE: You are run
  * F4 agentType (CC 198 锚 pretty.js:446608-446627): resolve `opts.agentType` against the registry
  * (deployment SHADOW over built-ins) and fold the definition into the child spec — persona as
  * `systemPrompt` (so {@link withWorkflowChildPersona} composes the return-contract NOTE via the
- * custom-persona APPEND arm = CC `O0m` semantics), model/thinking/maxTurns/skills/memory when the spec
- * didn't pin them, and allow/denyTools as a ToolPolicy (combined deny-wins with any spec policy).
+ * custom-persona APPEND arm = CC `O0m` semantics), model/thinking/maxTurns/skills/memory/
+ * memoryPersistenceCapable when the spec didn't pin them, and allow/denyTools as a ToolPolicy
+ * (combined deny-wins with any spec policy).
  * The definition is DEPLOYMENT-TRUSTED (registry-declared, not script-authored), so its model bypasses
  * the script-facing modelName allowlist by design — same trust tier as the Agent tool's registry.
  */
@@ -382,10 +383,12 @@ export interface RunWorkflowOptions {
      *  from ctx): every spawned agent composes the same closure (codex F2a). */
     parentCenterArtifactDigest?: string;
     parentCenterSourceRevision?: string;
-    /** The launching run's display sink (`RunInternals.onForwardEvent`, already filtered by the runner to
-     *  `task_progress`) — threaded into every spawned agent's trusted internals so the children's progress
-     *  ticks bubble out of their isolated streams to the deployment's one sink (fleet footer/monitor rows).
-     *  Display-only; absent ⇒ ticks stay in each child's own stream. */
+    /** The launching run's display sink (`RunInternals.onForwardEvent` behind the runner's ctx wrapper:
+     *  `task_progress` always, PLUS the children's content events — `text_delta`/`reasoning_delta`/
+     *  `tool_start`/`tool_end`, UNTRUSTED-RAW: the consumer must redact — when the HOST spec set
+     *  `forwardSubagentEvents: true`) — threaded into every spawned agent's trusted internals so the
+     *  children's events bubble out of their isolated streams to the deployment's one sink (fleet
+     *  footer/monitor rows). Display-only; absent ⇒ ticks stay in each child's own stream. */
     onForwardEvent?: (event: TaskEvent) => void;
     /** Parent effective-policy inheritance (tighten-only): the HOST task's evaluated gate chain
      *  (`ToolExecuteContext.inheritedGateForChildren()` — its session rules + toolPolicy/frozen onAsk +

package/dist/orchestration/workflow.js

@@ -105,6 +105,8 @@ export function applyWorkflowAgentType(spec, agentType, registry) {
         out.skills = def.skills;
     if (out.memory === undefined && def.memory !== undefined)
         out.memory = def.memory;
+    if (out.memoryPersistenceCapable === undefined && def.memoryPersistenceCapable !== undefined)
+        out.memoryPersistenceCapable = def.memoryPersistenceCapable;
     if (def.allowTools !== undefined || def.denyTools !== undefined) {
         const perType = createAllowDenyPolicy({ ...(def.allowTools ? { allow: def.allowTools } : {}), ...(def.denyTools ? { deny: def.denyTools } : {}) });
         out.toolPolicy = out.toolPolicy ? combinePolicies(out.toolPolicy, perType) : perType;