@sema-agent/core 5.26.0 → 5.27.0

package/dist/core/runner/prepare-task.d.ts

@@ -354,7 +354,10 @@ export interface Prepared {
      *  deferred; a caller with no accessor has no deferred family to describe. */
     staticFaceFor?: (name: string) => boolean;
     /**
-     * design/138 S1 — the MemoryEngine session (present iff `deps.memoryBackend` + `spec.memory.enabled`).
+     * design/138 S1 — the MemoryEngine session. Present when `deps.memoryBackend` + `spec.memory.enabled`
+     * hold AND the engine mount succeeded: a materialize failure without a `config.memory_*` code is
+     * fail-open (reported via `deps.onError`, the task runs memory-less), leaving this absent even though
+     * both flags hold.
      * `harvest` is the swallow-guarded boundary hook (task terminal in runtask + the checkpoint mint
      * point in commitSuspendSaga): it runs the FULL gate set (containment/secret/caps/deletion fuse),
      * commits entry patches to the backend, self-heals the derived index, and re-baselines (a second
@@ -1296,8 +1299,11 @@ export interface RunInternals {
      * design/99 (nested-subagent live tree) — an OPT-IN, DISPLAY-ONLY event sink a deployment sets on the TOP run to
      * receive a subagent's live `task_progress` ticks (which otherwise stay in the child's ISOLATED stream). Threaded
      * recursively down the delegation tree (via `ctx.forwardEvent`), so every nested subagent's ticks bubble to the
-     * SAME sink. The Runner forwards ONLY `task_progress` through it; the child stream is NEVER merged into the
-     * parent's MODEL context (this is purely a render channel). Absent unless the deployment opted in.
+     * SAME sink. The Runner's ctx wrapper forwards `task_progress` always; when the run's spec sets
+     * `forwardSubagentEvents: true` it ALSO forwards the child's content events (`text_delta` / `reasoning_delta` /
+     * `tool_start` / `tool_end` — the subagent viewing pane, carrying the same UNTRUSTED-RAW/consumer-must-redact
+     * contract as the main stream's tool events). Either way the child stream is NEVER merged into the parent's
+     * MODEL context (this is purely a render channel). Absent unless the deployment opted in.
      */
     onForwardEvent?: (event: TaskEvent) => void;
     /**

package/dist/core/runner/prepare-task.js

@@ -29,7 +29,7 @@ import { inlineUntrusted } from "../untrusted-text.js";
 import { policyAskClassOf } from "../ask-class.js";
 import { emitTrace } from "../trace.js";
 import { createSessionRulePolicy } from "./session-rule-policy.js";
-import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, runToolGate } from "../hooks.js";
+import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, persistedRuleMandateOf, runToolGate } from "../hooks.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
@@ -3260,9 +3260,25 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 },
             };
         })();
-        const ruleSuggestionsOf = (toolName, args) => {
+        const ruleSuggestionsOf = (toolName, args, ask) => {
             if (permissionRuleLane === undefined || toolName !== PERSISTED_RULE_TOOL)
                 return {};
+            if ((spec.principal === undefined || spec.principal === "") && deps.localOwnerRules !== true)
+                return {};
+            if (ask?.requiresRealApproval === true ||
+                ask?.persistedRuleShadowed !== undefined ||
+                ask?.decisionReason === "hook" ||
+                ask?.inheritedUnresolved === true ||
+                ask?.ancestorResolved === true) {
+                return {};
+            }
+            if (persistedRuleMandateOf({
+                egress: egressTools.has(toolName),
+                irreversibility: irreversibilityTier.get(toolName),
+                shellGated: shellGatedBash,
+            }) !== undefined) {
+                return {};
+            }
             const command = args?.command;
             if (typeof command !== "string")
                 return {};
@@ -3315,7 +3331,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     toolName: creq.toolName,
                     toolCallId: creq.toolCallId,
                     args: editArgs,
-                    ...ruleSuggestionsOf(creq.toolName, editArgs),
+                    ...ruleSuggestionsOf(creq.toolName, editArgs, { ...(re ?? {}), ancestorResolved: true }),
                     message: re.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                     ...askSourceIdentity(),
                     ...riskAxesOf(creq.toolName),
@@ -3400,7 +3416,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             toolName: creq.toolName,
                             toolCallId: creq.toolCallId,
                             args: presentedArgs,
-                            ...ruleSuggestionsOf(creq.toolName, presentedArgs),
+                            ...ruleSuggestionsOf(creq.toolName, presentedArgs, { ...(first.action === "ask" ? first : {}), ancestorResolved: true }),
                             message: first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                             ...askSourceIdentity(),
                             ...riskAxesOf(creq.toolName),
@@ -3487,7 +3503,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             toolName: creq.toolName,
                             toolCallId: creq.toolCallId,
                             args: presentedArgs,
-                            ...ruleSuggestionsOf(creq.toolName, presentedArgs),
+                            ...ruleSuggestionsOf(creq.toolName, presentedArgs, { ...(decision.action === "ask" ? decision : {}), ancestorResolved: true }),
                             message: decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                             ...askSourceIdentity(),
                             ...riskAxesOf(creq.toolName),
@@ -3800,7 +3816,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const preview = approvalPreviewOf(req.toolName, req.args);
                         return preview !== undefined ? { preview } : {};
                     })(),
-                    ...ruleSuggestionsOf(req.toolName, req.args),
+                    ...ruleSuggestionsOf(req.toolName, req.args, decision.action === "ask" ? decision : undefined),
                     message: decision.message ?? `approval required for "${req.toolName}"`,
                     ...askSourceIdentity(),
                     ...riskAxesOf(req.toolName),
@@ -4287,7 +4303,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             };
             const suspendAsk = parkLaneArmed && checkpointStore !== undefined
-                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule) => {
+                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason) => {
                     const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
                     if (syncFirstEligible &&
                         runtimeCaps?.forceDurableGate !== true &&
@@ -4442,7 +4458,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                     const preview = approvalPreviewOf(req.toolName, parkedArgs);
                                     return preview !== undefined ? { preview } : {};
                                 })(),
-                                ...ruleSuggestionsOf(req.toolName, parkedArgs),
+                                ...ruleSuggestionsOf(req.toolName, parkedArgs, {
+                                    ...(realApproval !== undefined ? { requiresRealApproval: true } : {}),
+                                    ...(shadowedRule !== undefined ? { persistedRuleShadowed: shadowedRule } : {}),
+                                    ...(askDecisionReason !== undefined ? { decisionReason: askDecisionReason } : {}),
+                                    ...(inheritedUnavailableAsks.has(req.toolCallId) ? { inheritedUnresolved: true } : {}),
+                                }),
                                 boundInputHash: boundInputHashOf(parkedArgs),
                                 batchToolCallIds,
                                 completedCallIds,

package/dist/core/runner/runtask.d.ts

@@ -250,7 +250,14 @@ export declare class Runner {
      *   env_failed re-resume supplied a decision ≠ the persisted winner), `reopened_concurrently` (the
      *   optimistic-concurrency `rev` changed under a concurrent resolve/reopen — re-resume against current
      *   state), `unsupported_version` (checkpoint newer than this worker / remote handle with no factory),
-     *   `already_resolved` (lost the CAS — idempotent no-op).
+     *   `already_resolved` (lost the CAS — idempotent no-op), `walltime_axis_retired` (pre-CAS: the
+     *   persisted ledger carries the retired wall-clock budget axis — a worker of the previous release can
+     *   still finish it), `resume_aborted` (the caller's signal was already aborted at entry, or aborted
+     *   during the resume — pre-CAS/edit-re-adjudication legs leave the checkpoint pending and resumable,
+     *   the post-claim leg leaves it consumed; the message says which), `reopen_failed` (an aborted resume
+     *   needed to reopen the checkpoint and the store refused, or the reopen failed in flight — the message
+     *   distinguishes terminally-consumed from state-unprovable). Each code's full contract is on
+     *   {@link CheckpointError.code}.
      */
     resume(token: CheckpointToken, outcome: ResumeOutcome, taskConfig: ResumeTaskConfig, 
     /** RB-48② (1.404): same TRUSTED run-internals seam as {@link resumeStream} — the convenience wrapper

package/dist/core/task-registry-agent.d.ts

@@ -415,9 +415,10 @@ export declare function notFoundRunningAgentsTail(footer: {
  *  so a structured consumer lost the failure FACT at exactly the moment it could no longer reach the
  *  live handle, left to scrape the prose body's `error:` line.
  *
- *  The status GATES live here too (killed ⇒ stoppedBy, failed ⇒ error/errorCode/retryable) rather than
- *  at the call sites: which facts a given status may carry is part of the same contract, and a gate
- *  copied per face is the same drift with extra steps. `error` is model/provider-influenceable text, so
+ *  The fact gates live here too (failed ⇒ error/errorCode/retryable/retryAfterMs; `stoppedBy` rides
+ *  whenever the ROW carries it, on any status — a reaper-settled `failed` row keeps its attribution,
+ *  see the widening note in the builder) rather than at the call sites: which facts a given row may
+ *  carry is part of the same contract, and a gate copied per face is the same drift with extra steps. `error` is model/provider-influenceable text, so
  *  the fencing + bounding (RB-386②'s posture) happens once, here, for both faces.
  *  The parked projection is this builder with fewer facts, not a third literal. */
 export interface AgentPollDetailsInput {

package/dist/core/task-registry.d.ts

@@ -33,8 +33,10 @@ export interface RegisterBackgroundBashInput extends TaskAccess {
     /** CC 2.1.209 对齐批A A5: the task's OUTPUT FILE — the launch receipt advertises it and the watcher
      *  mirrors every polled increment into it (append-only, unbounded — unlike the rolling in-memory
      *  spool), so "Read the output file path" is a real alternative to TaskOutput. Terminal
-     *  task-notifications carry the same path (`output_file`). Only meaningful with `onTerminal` (the
-     *  watcher is the writer); callers create the file (empty) before registering. */
+     *  task-notifications carry the same path (`output_file`). Primarily meaningful with `onTerminal`
+     *  (only the watcher mirrors increments live); a watcher-less row still gets ONE final best-effort
+     *  append at TaskStop/run-teardown (the tail drain), so the file is written even without a watcher —
+     *  there is just no live mirror. Callers create the file (empty) before registering. */
     outputFile?: string;
 }
 export interface TaskPollOptions {
@@ -369,7 +371,8 @@ export declare class TaskRegistry {
      *  BEFORE the abort()/status flip — the ordering is load-bearing: the guard below refuses markers on a
      *  non-running handle, so a caller that flips first loses its claim and attribution falls back to
      *  "system". First-marker-wins: an earlier marker (e.g. a service-wire "user") is never overwritten.
-     *  Applies to background_agent AND background_bash (same class); workflow cancellation is out of scope. */
+     *  Applies to background_agent, background_bash AND monitor handles (the markable kinds — the monitor
+     *  watcher/stop lanes mark and read it too); workflow cancellation is out of scope. */
     markStopSource(id: string, source: StopSource): void;
     /**
      * [1712] / RB-164 — attribute an ENV-LEVEL blanket sweep before it runs.

package/dist/core/tool-policy.d.ts

@@ -632,9 +632,16 @@ export interface AskRequest {
     /**
      * design/179 §4 — the persistable allow-rule forms this exact call could be covered by, so a surface can
      * offer "allow, and stop asking me this" with something concrete behind it. Present only when a
-     * persisted allow-rule lane is armed AND the call is one the lane can speak for: a compound, a
+     * persisted allow-rule lane is armed AND the call is one the lane can speak for (a compound, a
      * redirection or a substitution yields NO suggestion, which is the honest answer rather than an option
-     * that would be refused on redemption.
+     * that would be refused on redemption) AND the ask is one a persisted rule could actually clear — a
+     * mandated ask (operator shellGate:"always", the tool's own egress/irreversibility marks, a
+     * `requiresRealApproval` demand) and an ask carrying {@link persistedRuleShadowed} offer none.
+     *
+     * CONTRACT — array order is display order, narrowest first: the EXACT form is always index 0, a
+     * broader reviewed PREFIX form (at most one) follows. Basis ≤ 2. Selection indices and redemption
+     * tickets are keyed against this order, and the durable park row carries the same array under the
+     * same contract.
      *
      * ADVISORY display metadata, never adjudication input, and never a rule by itself: minting one is a
      * separate act that goes through the approval-record protocol, so a surface that ignores this field

package/dist/core/types.d.ts

@@ -855,8 +855,11 @@ export interface ToolExecuteContext {
      * `RunInternals.onForwardEvent`) to receive a SUBAGENT's live `task_progress` ticks that otherwise stay in the
      * child's ISOLATED stream. A delegation tool threads it to the child so nested progress bubbles to one sink. This
      * is a DISPLAY channel ONLY — the child stream is NEVER merged into the parent's MODEL context, and nothing
-     * security-relevant consumes a forwarded event. Present ONLY when the deployment opted in; the Runner filters it
-     * to `task_progress` (a tool cannot push other event types). ⚠️ Forwarded ticks are UNTRUSTED display hints — any
+     * security-relevant consumes a forwarded event. Present ONLY when the deployment opted in. The tool-ctx wrapper
+     * passes `task_progress` unconditionally and — when the deployment sets `forwardSubagentEvents: true` — the
+     * transcript classes too (text_delta/reasoning_delta/tool_start/tool_end); other event types never cross it.
+     * The delegation lane's OWN tap is trusted and forwards the child's FULL event stream (bg frames tagged
+     * with bgAgentId). ⚠️ Forwarded ticks are UNTRUSTED display hints — any
      * tool holding this ctx could forge one, so a consumer validates `parentTaskId` against its known runs.
      */
     forwardEvent?: (event: TaskEvent) => void;
@@ -1871,7 +1874,9 @@ export interface TaskSpec {
      * write-capable fs tools (CC's same gate); zero cost/behavior change otherwise. `false` opts out.
      */
     lspDiagnostics?: boolean;
-    /** In-process hooks (PreToolUse/PostToolUse/UserPromptSubmit) for this task. Overrides `RunnerDeps.hooks`. */
+    /** In-process hooks for this task — the full `Hooks` lifecycle seam (tool pre/post/failure/batch
+     *  interception, prompt gating, stop pushback, compaction taps, permission-denied observation; each
+     *  member's contract is on the interface). Overrides `RunnerDeps.hooks`. */
     hooks?: import("./hooks.js").Hooks;
     /**
      * design/45 **durable suspend-on-approval** (F4). When set AND a `CheckpointStore` is wired
@@ -4729,10 +4734,15 @@ export interface RunnerDeps {
      *  task's own `lspManager` overrides this. Unset ⇒ no `lsp` tool. */
     lspManager?: import("./lsp.js").LspServerManager;
     /**
-     * Default in-process hooks for all tasks (design/37): PreToolUse (rewrite/restrict args + inject
-     * context), PostToolUse (rewrite output + inject context), UserPromptSubmit (block/inject before the
-     * objective becomes a message). A task's own `hooks` overrides this. A PreToolUse hook's `allow`
-     * never bypasses `toolPolicy` — the policy is always the final say.
+     * Default in-process hooks for all tasks (design/37) — the FULL lifecycle seam of the `Hooks`
+     * interface, not just the tool-call trio: `preToolUse` (rewrite/restrict args + inject context),
+     * `postToolUse` (rewrite output + inject context), `userPromptSubmit` (block/inject before the
+     * objective becomes a message), plus `stop` (push back when the run would otherwise end and continue
+     * it), `postToolUseFailure` / `postToolBatch` / `permissionDenied` (failure, batch-boundary and
+     * deny observers), `preCompact` / `postCompact` (compaction gate + observer), `stopFailure`
+     * (API-error terminal observer) and the `preToolUseObservational` declaration flag — each member's
+     * contract is documented on the `Hooks` interface itself. A task's own `hooks` overrides this. A
+     * PreToolUse hook's `allow` never bypasses `toolPolicy` — the policy is always the final say.
      */
     hooks?: import("./hooks.js").Hooks;
     /**
@@ -4750,12 +4760,30 @@ export interface RunnerDeps {
      * - `"prompt-constitution"` — a `stableSystem` provider returned an ALREADY-assembled prompt
      *   (constitution anchor found); core passed it through un-doubled. Upgrade the provider to return
      *   only the role base (or set `replaceAll: true` to own the whole base).
+     * - `"degraded"` — the task kept running with a capability quietly reduced: a question auto-answered
+     *   with no human present, a skipped env git snapshot, a lost checkpoint-put confirmation, an
+     *   unroutable descendant notification, and similar best-effort arms. The run proceeds; the reduced
+     *   arm is what is being disclosed (`classification` names it).
+     * - `"config"` — a deployment-wiring problem detected while preparing or tearing down a task: tool
+     *   mount conflicts, refused/ignored knob values, gate-off notices, store/env teardown legs. The
+     *   broadest class by call-site count — most misconfigurations announce here rather than failing
+     *   the task.
      * - `"memory"` — a post-task memory-consolidation pass failed or skipped a malformed reconcile
      *   decision (design/41). Best-effort: the notes the model saved are kept; the task still succeeds.
      * - `"mcp"` — an MCP server failed to connect / list its tools and was skipped (fail-open, design/29);
      *   the task runs with the remaining servers' tools. One call per failed server.
      * - `"a2a"` — the A2A sibling of `"mcp"`: a declared peer's agent card could not be fetched/read, or it
      *   advertises no transport this client speaks, so the peer was skipped. One call per skipped peer.
+     * - `"interrupt-reconcile"` — repairing an interrupted session's transcript on re-entry (synthesizing
+     *   tool results for orphaned calls, flushing held session writes) failed; the run proceeds on the
+     *   unrepaired transcript.
+     * - `"suggestions"` — the best-effort follow-up-suggestions pass failed or timed out; the result
+     *   simply carries no suggestions.
+     * - `"rewind"` — the per-turn working-tree snapshot backing file rewind failed or was skipped (e.g. a
+     *   too-large root inside its cooldown window); turns without a snapshot cannot be rewound to.
+     * - `"hook"` — a deployment hook misbehaved: a callback threw, or returned a verdict it was not
+     *   allowed to (e.g. a declared-observational hook). The engine applies the hook's own documented
+     *   fallback (swallow, or fail-closed deny, per its contract) and reports the fact here.
      */
     onError?: (err: unknown, context: {
         phase: "compaction" | "prompt-cache" | "prompt-constitution" | "degraded" | "config" | "memory" | "mcp" | "a2a" | "interrupt-reconcile" | "suggestions" | "rewind" | "hook";

package/dist/engine/loop/types.d.ts

@@ -23,7 +23,11 @@ export type ToolExecutionMode = "sequential" | "parallel";
  * Controls how many queued user messages are injected when the agent loop reaches a queue drain point.
  *
  * - "all": drain and inject every queued message at that point.
- * - "one-at-a-time": drain and inject only the oldest queued message, leaving the rest queued for later drain points.
+ * - "one-at-a-time": drain and inject only the oldest queued message, leaving the rest queued for later
+ *   drain points. Exception: when the oldest frame is an engine note (a task-notification sidecar
+ *   payload), every consecutive engine-note frame behind it drains with it as ONE batch, stopping at
+ *   the first non-note frame (e.g. a real user steer) — N buffered completion notices are one
+ *   boundary's worth of frames, not N sequential turns.
  */
 export type QueueMode = "all" | "one-at-a-time";
 /** A single tool call content block emitted by an assistant message. */
@@ -394,8 +398,11 @@ export interface AgentLoopConfig extends SimpleStreamOptions {
 }
 /**
  * Thinking/reasoning level for models that support it.
- * Note: "xhigh" is only supported by selected model families. Use model thinking-level metadata
- * from openclaw/plugin-sdk/llm to detect support for a concrete model.
+ * Note: "xhigh" is only supported by selected model families. Per-model/per-endpoint support is
+ * declared in this package's model metadata (`src/engine/llm/types.ts`): the compat blocks'
+ * accepted-tier sets (`reasoningEffortLevels` on the OpenAI-family compats, `effortLevels` on the
+ * Anthropic Messages compat — a requested tier above the declared set clamps down rather than
+ * erroring), and `Model.thinkingLevelMap`, where `null` marks a level as unsupported.
  */
 export type ThinkingLevel = "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
 export interface BashExecutionMessage {

package/dist/index.d.ts

@@ -87,7 +87,7 @@ export type { InvariantKind, FunctionContract, Invariant, InvariantViolation, Ch
 export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, type BashReadonlyRootBoundary, type CompoundReadonlyVerdict, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
-export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, } from "./core/tool-result-store.js";
+export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, type UsageWindow, type UsageWindowStore, type UsageWindowReading, type UsageWindowRecord, type UsageSlot, type UsageBucketRow, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";

package/dist/index.js

@@ -68,7 +68,7 @@ export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
 export { HAND_TOOL_EFFECTS, bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
-export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, MAX_MINTED_TOOL_RESULT_REF_CHARS, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, } from "./core/tool-result-store.js";
+export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";

package/dist/orchestration/run-workflow-tool.d.ts

@@ -229,9 +229,11 @@ export interface RunWorkflowToolDeps {
      *  has inherited this hook since [893]④a; the workflow lane never did — the governance whitelist
      *  rightly blocks SCRIPTS from setting it, but host inheritance is a different lane. */
     parentGetApiKeyAndHeaders?: import("../core/types.js").TaskSpec["getApiKeyAndHeaders"];
-    /** The HOST run's display sink (its `RunInternals.onForwardEvent`, already filtered to `task_progress`
-     *  by the runner's ctx wrapper) — threaded via `startWorkflow` into every spawned agent's trusted
-     *  internals so a workflow child's progress ticks bubble to the deployment's one sink, the same
+    /** The HOST run's display sink (its `RunInternals.onForwardEvent` behind the runner's ctx wrapper:
+     *  `task_progress` always, plus the children's content events — `text_delta`/`reasoning_delta`/
+     *  `tool_start`/`tool_end`, UNTRUSTED-RAW: the consumer must redact — when the HOST spec set
+     *  `forwardSubagentEvents: true`) — threaded via `startWorkflow` into every spawned agent's trusted
+     *  internals so a workflow child's events bubble to the deployment's one sink, the same
      *  channel a `createSubagentTool` delegation threads. Display-only; absent ⇒ ticks stay in each
      *  child's own stream. (A dep, not read off the execute ctx: the mounted tool's `AgentTool.execute`
      *  wrapper builds a minimal `{toolCallId, signal}` ctx — the rich-ctx injection only wraps

package/dist/orchestration/workflow.d.ts

@@ -31,8 +31,9 @@ export declare const WORKFLOW_SUBAGENT_APPEND_SCHEMA = "---\n\nNOTE: You are run
  * F4 agentType (CC 198 锚 pretty.js:446608-446627): resolve `opts.agentType` against the registry
  * (deployment SHADOW over built-ins) and fold the definition into the child spec — persona as
  * `systemPrompt` (so {@link withWorkflowChildPersona} composes the return-contract NOTE via the
- * custom-persona APPEND arm = CC `O0m` semantics), model/thinking/maxTurns/skills/memory when the spec
- * didn't pin them, and allow/denyTools as a ToolPolicy (combined deny-wins with any spec policy).
+ * custom-persona APPEND arm = CC `O0m` semantics), model/thinking/maxTurns/skills/memory/
+ * memoryPersistenceCapable when the spec didn't pin them, and allow/denyTools as a ToolPolicy
+ * (combined deny-wins with any spec policy).
  * The definition is DEPLOYMENT-TRUSTED (registry-declared, not script-authored), so its model bypasses
  * the script-facing modelName allowlist by design — same trust tier as the Agent tool's registry.
  */
@@ -382,10 +383,12 @@ export interface RunWorkflowOptions {
      *  from ctx): every spawned agent composes the same closure (codex F2a). */
     parentCenterArtifactDigest?: string;
     parentCenterSourceRevision?: string;
-    /** The launching run's display sink (`RunInternals.onForwardEvent`, already filtered by the runner to
-     *  `task_progress`) — threaded into every spawned agent's trusted internals so the children's progress
-     *  ticks bubble out of their isolated streams to the deployment's one sink (fleet footer/monitor rows).
-     *  Display-only; absent ⇒ ticks stay in each child's own stream. */
+    /** The launching run's display sink (`RunInternals.onForwardEvent` behind the runner's ctx wrapper:
+     *  `task_progress` always, PLUS the children's content events — `text_delta`/`reasoning_delta`/
+     *  `tool_start`/`tool_end`, UNTRUSTED-RAW: the consumer must redact — when the HOST spec set
+     *  `forwardSubagentEvents: true`) — threaded into every spawned agent's trusted internals so the
+     *  children's events bubble out of their isolated streams to the deployment's one sink (fleet
+     *  footer/monitor rows). Display-only; absent ⇒ ticks stay in each child's own stream. */
     onForwardEvent?: (event: TaskEvent) => void;
     /** Parent effective-policy inheritance (tighten-only): the HOST task's evaluated gate chain
      *  (`ToolExecuteContext.inheritedGateForChildren()` — its session rules + toolPolicy/frozen onAsk +

package/dist/stores/file/checkpoint-store.d.ts

@@ -1,7 +1,8 @@
 import { type Checkpoint, type PendingSteerInput, type CheckpointFaultMode, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type ReopenReason, type ResolveExpectation, type ResumeOutcome } from "../../core/checkpoint-store.js";
 export interface FileCheckpointStoreOptions {
     /** When false, an `appendLine` for a state transition is NOT fsync'd. The checkpoint COMMIT POINT always
-     *  fsyncs regardless (its crash-safety depends on it); this only affects whether `put` fsyncs. Default true. */
+     *  fsyncs regardless (its crash-safety depends on it); this governs the `put` and `setPendingSteer`
+     *  (steer-append) commits only — `resolve`/`reopen`/`expire` fsync unconditionally. Default true. */
     fsync?: boolean;
     /** Compact the ledger into a snapshot once it exceeds this many events (then truncate). Default 1000. */
     compactEvery?: number;

package/dist/stores/file/index.d.ts

@@ -52,7 +52,7 @@ export interface FileStorageBackendOptions {
     /** `TtlSessionStore` idle-eviction policy. Default `"forget"` (§7 decision 5 — durable history is never
      *  deleted by an idle timer). */
     evict?: EvictPolicy;
-    /** Checkpoint store tuning (fsync cadence for `put`, ledger compaction threshold). */
+    /** Checkpoint store tuning (fsync cadence for `put`/`setPendingSteer`, ledger compaction threshold). */
     checkpoint?: FileCheckpointStoreOptions;
     /** design/101 §E19 — file-snapshot enumerator bounds (maxFiles/maxBytes/ignoreDirs). Default
      *  {@link DEFAULT_SNAPSHOT_BOUNDS}. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "5.26.0",
+  "version": "5.27.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",