@sema-agent/core 5.33.0 → 5.35.0

package/dist/core/runner/prepare-task.js

@@ -20,7 +20,7 @@ import { createSubagentWorktreeHelper, forkGovernanceDenial } from "../../agents
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
+import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
 const PERSISTED_RULE_TOOL = "Bash";
 import { findAdmittingRule, suggestRulesForCommand } from "../permission-rule-model.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
@@ -88,6 +88,7 @@ import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
 import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { countElicitOptIns, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam } from "../wiring-manifest.js";
+import { durableParkGapFor } from "../park-selfcheck.js";
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs } from "../usage-window-store.js";
 import { deliverEngineNotice } from "../types.js";
 const announcedMaterializeEnv = new Set();
@@ -192,6 +193,46 @@ async function forgetQuietly(sessions, sessionId) {
     catch {
     }
 }
+function screenGateSettlement(result, settling) {
+    const defects = [];
+    const reportedBy = result.settledBy;
+    let settledBy;
+    if (reportedBy !== undefined) {
+        if (!isApprovalSettledBy(reportedBy) || (!settling && reportedBy !== "human")) {
+            defects.push(`a tool-gate settlement reported settledBy "${String(reportedBy)}" on ${settling ? "a blocked" : "an executing"} call — ` +
+                `it is one of "human" / "timeout" / "aborted", and only "human" can be the source of a call that runs; the frame carries no source`);
+        }
+        else
+            settledBy = reportedBy;
+    }
+    const attribution = screenApproverAttribution(result.approver);
+    if (attribution.defect !== undefined) {
+        defects.push(`a tool-gate settlement reported an attribution this engine refuses: ${attribution.defect}; the frame carries no approver`);
+    }
+    const record = {
+        ...(settledBy !== undefined ? { settledBy } : {}),
+        ...(attribution.approver !== undefined ? { approver: attribution.approver } : {}),
+    };
+    return { ...(settledBy !== undefined || attribution.approver !== undefined ? { record } : {}), defects };
+}
+function inheritedAskRuleEvidence(deps) {
+    const org = deps.permissionRuleOrg === undefined ? "not_wired" : "not_adjudicated";
+    const personal = deps.permissionRuleStore === undefined ? "not_wired" : "not_adjudicated";
+    return Object.freeze({ orgRevisionAbsent: org, orgRuleAbsent: org, personalRuleDotsAbsent: personal });
+}
+function orgRevisionEvidenceOf(resolution, onDefect) {
+    const reported = resolution.revision;
+    if (reported === undefined)
+        return {};
+    if (typeof reported === "number" && Number.isFinite(reported))
+        return { revision: reported };
+    onDefect(`the org rule overlay reported revision ${JSON.stringify(reported)} — a snapshot revision is a finite number; ` +
+        `the adjudication stands, but the ask carries no revision evidence for this call`);
+    return {};
+}
+function persistedRuleHitOf(admitting) {
+    return admitting === undefined ? undefined : { rule: admitting.rule, dots: admitting.adds.map((a) => ({ actor: a.dot.actor, counter: a.dot.counter })) };
+}
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
@@ -204,7 +245,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         e.code = "resume.session_not_found";
         throw e;
     }
-    const { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects });
+    const { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects, ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
     const sessionId = acquired.sessionId;
     const hostTaskId = spec.taskId ?? sessionId;
     if (compModel !== undefined) {
@@ -2778,6 +2819,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return {};
             return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
         };
+        const inheritedAskEvidence = inheritedAskRuleEvidence(deps);
         const permissionRuleLane = (() => {
             const provider = deps.permissionRuleStore;
             const localOwnerDeclared = deps.localOwnerRules === true;
@@ -2817,9 +2859,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             message: err instanceof Error ? err.message : String(err),
                             ts: Date.now(),
                         }));
-                        return undefined;
+                        return { unreadable: true };
                     }
-                    return findAdmittingRule(listed.rules, { tool: req.toolName, command, cwd: root })?.rule;
+                    return persistedRuleHitOf(findAdmittingRule(listed.rules, { tool: req.toolName, command, cwd: root }));
                 },
             };
         })();
@@ -2840,11 +2882,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                     if (resolution.status === "unavailable")
                         return { status: "unavailable", disclosures: resolution.disclosures };
+                    const revisionCell = orgRevisionEvidenceOf(resolution, (message) => deps.onError?.(new Error(message), { phase: "config", sessionId }));
                     const command = req.args?.command;
                     if (req.toolName !== PERSISTED_RULE_TOOL || typeof command !== "string")
-                        return { status: "available" };
+                        return { status: "available", ...revisionCell };
                     const verdict = orgRuleVerdictFor(resolution.rules, { tool: req.toolName, command });
-                    return verdict === undefined ? { status: "available" } : { status: "available", verdict };
+                    return verdict === undefined ? { status: "available", ...revisionCell } : { status: "available", verdict, ...revisionCell };
                 },
             };
         })();
@@ -2926,6 +2969,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...riskAxesOf(creq.toolName),
                     ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     ...(re.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: re.persistedRuleShadowed } : {}),
+                    ruleEvidence: inheritedAskEvidence,
                 }, onAskOf, csignal ?? abortController.signal);
                 if (rr.action !== "allow")
                     return rr;
@@ -3011,6 +3055,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             ...riskAxesOf(creq.toolName),
                             ...(first.action === "ask" && first.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                             ...(first.action === "ask" && first.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: first.persistedRuleShadowed } : {}),
+                            ruleEvidence: inheritedAskEvidence,
                         }, pc.onAsk, csignal ?? abortController.signal);
                         const askWaitMs = Math.max(0, now() - askT0);
                         if (resolved.action === "deny" && resolved.approverUnavailable === true) {
@@ -3098,6 +3143,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             ...riskAxesOf(creq.toolName),
                             ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                             ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),
+                            ruleEvidence: inheritedAskEvidence,
                         }, pc.onAsk, csignal ?? abortController.signal);
                         const askWaitMs = Math.max(0, now() - askT0);
                         if (resolved.action === "deny" && resolved.approverUnavailable === true) {
@@ -3239,7 +3285,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         const preToolContexts = new Map();
         const blockedToolCalls = new Set();
-        const approvalSettledBy = new Map();
+        const approvalSettlement = new Map();
         const blockedTracked = Boolean(hooks?.postToolUse || hooks?.preToolUse || hooks?.postToolUseFailure || hooks?.postToolBatch);
         const restoreSurfaceGap = ownedEnv !== undefined && isRemoteExecutionEnv(ownedEnv) && ownedEnv.capabilities.suspendable ? missingRestoreSurface(ownedEnv) : [];
         const incompleteSuspendAdapter = restoreSurfaceGap.length > 0 ? restoreSurfaceGap : undefined;
@@ -3413,6 +3459,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),
                     ...(decision.action === "ask" && decision.probeReason !== undefined ? { probeReason: decision.probeReason } : {}),
                     ...(decision.action === "ask" && decision.probeCause !== undefined ? { probeCause: decision.probeCause } : {}),
+                    ...(decision.action === "ask" && decision.ruleEvidence !== undefined ? { ruleEvidence: decision.ruleEvidence } : {}),
                 }, onAsk, abortController.signal);
                 const waitMs = Math.max(0, now() - t0);
                 if (resolved.approverUnavailable !== true) {
@@ -4230,17 +4277,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     if (blockedTracked && (result.block || result.suspend)) {
                         blockedToolCalls.add(e.toolCallId);
                     }
-                    const reported = result.settledBy;
-                    if (reported !== undefined) {
-                        const settling = result.block === true;
-                        if (!isApprovalSettledBy(reported) || (!settling && reported !== "human")) {
-                            deps.onError?.(new Error(`a tool-gate settlement reported settledBy "${String(reported)}" on ${settling ? "a blocked" : "an executing"} call — ` +
-                                `it is one of "human" / "timeout" / "aborted", and only "human" can be the source of a call that runs; the frame carries no source`), { phase: "config", sessionId });
-                        }
-                        else {
-                            approvalSettledBy.set(e.toolCallId, reported);
-                        }
-                    }
+                    const settlement = screenGateSettlement(result, result.block === true);
+                    for (const defect of settlement.defects)
+                        deps.onError?.(new Error(defect), { phase: "config", sessionId });
+                    if (settlement.record !== undefined)
+                        approvalSettlement.set(e.toolCallId, settlement.record);
                     return result.block
                         ? { block: true, reason: result.reason }
                         : result.updatedInput !== undefined
@@ -4552,7 +4593,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectiveReadFaceObserved = carrierReadFace();
         const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettledBy, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/runtask.d.ts

@@ -80,13 +80,18 @@ declare function toolEndBodyFrom(result: unknown, isError: boolean,
  *  a parameter and never derived from `result`: a tool's own `details` (which post-tool hooks may
  *  also replace) is writable by layers that adjudicate nothing, so reading provenance out of it would
  *  let a failing tool claim a person approved it. Omitted ⇒ this call settled no approval. */
-settledBy?: ApprovalSettledBy): {
+settledBy?: ApprovalSettledBy, 
+/** design/252 G-7 — WHOSE settlement, from the same caller and the same channel as `settledBy`, and
+ *  for the same reason it is a parameter: an attribution read out of a tool's own result would let a
+ *  tool name the person who approved it. Omitted ⇒ this call's settlement named nobody. */
+approver?: string): {
     output?: unknown;
     truncated?: boolean;
     totalChars?: number;
     structured?: unknown;
     errorCode?: string;
     settledBy?: ApprovalSettledBy;
+    approver?: string;
 };
 /**
  * scan-1/A1 — the BODY of the synthetic `tool_end` that closes a reconcile-recovered orphan. ONE

package/dist/core/runner/runtask.js

@@ -1,8 +1,8 @@
 import { persistedReadDenyEntryProblem } from "../../tools/fs/read-deny.js";
-import { createSafeNotifier } from "../safe-notify.js";
+import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
 import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
-import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, F012_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
+import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, F012_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, LEGACY_PENDING_STEER_INPUT_ID, MAX_STEER_INPUT_ID_CHARS, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
 import { engineVersion } from "../version.js";
 import { CONFIG_CATALOG_VERSION, declarationReasons, resolveEffectiveConfig } from "../../config/catalog.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
@@ -41,7 +41,7 @@ import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntr
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
-import { checkToolPolicyProjection, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, refuseOutOfContractDecision, toolPolicyNameSets } from "../tool-policy.js";
+import { checkToolPolicyProjection, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, refuseOutOfContractDecision, screenApproverAttribution, toolPolicyNameSets } from "../tool-policy.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { discloseDroppedPending, isDelegatedAgentTerminal, PendingSessionNotifications, renderTaskNotificationXml, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
 import { ToolDetachHub } from "../tool-detach.js";
@@ -68,6 +68,13 @@ function nextHumanInputSeq(key) {
     }
     return ++box.n;
 }
+function sameAcceptedSteerInput(a, b) {
+    return (a.payload === b.payload &&
+        a.trusted === b.trusted &&
+        a.actor?.id === b.actor?.id &&
+        a.actor?.hostAsserted === b.actor?.hostAsserted &&
+        a.actor?.issuer === b.actor?.issuer);
+}
 const MAX_CONSECUTIVE_COMPACTION_FAILURES = 3;
 const STOP_HOOK_BLOCK_CAP = 8;
 const COMPACTION_REGROWTH_FACTOR = 1.5;
@@ -130,7 +137,7 @@ function resumeDecisionWasNegative(resume) {
 }
 const DEFERRED_REISSUE = "[DEFERRED] This tool call shared a batch with a call that suspended for durable approval, so it was " +
     "NOT executed on resume. If you still need it, issue it again now.";
-function toolEndBodyFrom(result, isError, settledBy) {
+function toolEndBodyFrom(result, isError, settledBy, approver) {
     const o = toolOutputFrom(result);
     const st = structuredFrom(result);
     const det = isError ? result?.details : undefined;
@@ -142,6 +149,7 @@ function toolEndBodyFrom(result, isError, settledBy) {
         ...(st !== undefined ? { structured: st } : {}),
         ...(typeof code === "string" ? { errorCode: code } : {}),
         ...(settledBy !== undefined ? { settledBy } : {}),
+        ...(approver !== undefined ? { approver } : {}),
     };
 }
 export function reconciledToolEndBody(orphan) {
@@ -1154,7 +1162,7 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
                 rs.counters.groundingSignalPostR9 = true;
         }
         const activityArg = primaryActivityArg(event.args);
-        internalsNotifier.notify(() => internals?.onActivity?.({ phase: "start", toolCallId: event.toolCallId, toolName: event.toolName, at: startAt, ...(activityArg !== undefined ? { arg: activityArg } : {}) }), "runtask.onActivity.start");
+        internalsNotifier.notify(() => observeThenableRejection(internals?.onActivity?.({ phase: "start", toolCallId: event.toolCallId, toolName: event.toolName, at: startAt, ...(activityArg !== undefined ? { arg: activityArg } : {}) }), internalsNotifier, "runtask.onActivity.start"), "runtask.onActivity.start");
         pushContent({
             type: "tool_start",
             toolCallId: event.toolCallId,
@@ -1203,7 +1211,7 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
             ok: !event.isError,
             ts: toolNow,
         }));
-        internalsNotifier.notify(() => internals?.onActivity?.({ phase: "end", toolCallId: event.toolCallId, toolName: event.toolName, isError: event.isError, at: toolNow }), "runtask.onActivity.end");
+        internalsNotifier.notify(() => observeThenableRejection(internals?.onActivity?.({ phase: "end", toolCallId: event.toolCallId, toolName: event.toolName, isError: event.isError, at: toolNow }), internalsNotifier, "runtask.onActivity.end"), "runtask.onActivity.end");
         if (prepared.lspDiagnostics && !event.isError) {
             const name = event.toolName;
             if (name === "Edit" || name === "Write" || name === "NotebookEdit") {
@@ -1213,16 +1221,16 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
                     prepared.lspDiagnostics.nudge(p);
             }
         }
-        const settledBy = prepared.approvalSettledBy.get(event.toolCallId);
-        if (settledBy !== undefined)
-            prepared.approvalSettledBy.delete(event.toolCallId);
+        const settlement = prepared.approvalSettlement.get(event.toolCallId);
+        if (settlement !== undefined)
+            prepared.approvalSettlement.delete(event.toolCallId);
         pushContent({
             type: "tool_end",
             toolCallId: event.toolCallId,
             toolName: event.toolName,
             ...(toolLabels.get(event.toolName) !== undefined ? { label: toolLabels.get(event.toolName) } : {}),
             isError: event.isError,
-            ...toolEndBodyFrom(event.result, event.isError, settledBy),
+            ...toolEndBodyFrom(event.result, event.isError, settlement?.settledBy, settlement?.approver),
             ...ident(),
         });
         announceWorkspaceMove();
@@ -1444,6 +1452,7 @@ export class Runner {
         };
         let reapHandle;
         let steerChain = Promise.resolve();
+        const acceptedSteerInputs = new Map();
         const notifyRef = {};
         const manualCompactRef = { requested: false, waiters: [] };
         const drainManualCompactWaiters = (outcome) => {
@@ -1565,6 +1574,7 @@ export class Runner {
             queue.push({ type: "done", result: resultValue });
             queue.close();
         });
+        void settled.then(() => acceptedSteerInputs.clear(), () => acceptedSteerInputs.clear());
         const steeringError = (msg, code = "steering.not_running") => {
             const e = new Error(`cannot steer: ${msg}`);
             e.code = code;
@@ -1613,22 +1623,40 @@ export class Runner {
                 return suggestionsDone.catch(() => []);
             },
             steer: async (text, options) => {
-                if (options?.trusted && sanitizeUntrustedText(text) !== text) {
+                const trusted = options?.trusted ? true : false;
+                if (trusted && sanitizeUntrustedText(text) !== text) {
                     throw steeringError("trusted steering text must not contain a </system-reminder> tag", "steering.invalid_content");
                 }
-                const actor = options?.actor === undefined ? undefined : snapshotActorAssertion(options.actor);
+                const inputId = options?.inputId;
+                if (inputId !== undefined) {
+                    if (typeof inputId !== "string") {
+                        throw steeringError("inputId must be a string when supplied", "steering.invalid_content");
+                    }
+                    if (inputId === "" || inputId.length > MAX_STEER_INPUT_ID_CHARS) {
+                        throw steeringError(`inputId must be a non-empty string of at most ${MAX_STEER_INPUT_ID_CHARS} characters`, "steering.invalid_content");
+                    }
+                    if (inputId === LEGACY_PENDING_STEER_INPUT_ID) {
+                        throw steeringError(`inputId "${LEGACY_PENDING_STEER_INPUT_ID}" is reserved for a pre-queue parked steer and cannot be supplied by a caller`, "steering.invalid_content");
+                    }
+                }
+                const actorIn = options?.actor;
+                const actor = actorIn === undefined ? undefined : snapshotActorAssertion(actorIn);
                 const projected = projectHumanInput({ text, actor, source: "steer" });
-                const payload = options?.trusted ? formatHookFeedback(projected) : projected;
+                const payload = trusted ? formatHookFeedback(projected) : projected;
                 const mintsAFrame = payload.trim().length !== 0;
-                const emitAccepted = (h) => {
+                const replay = { payload, trusted, ...(actor !== undefined ? { actor } : {}) };
+                const noteAccepted = (h) => {
                     if (!mintsAFrame)
                         return;
+                    if (typeof inputId === "string")
+                        acceptedSteerInputs.set(inputId, replay);
                     queue.push({
                         ...buildHumanInputEvent({
                             carrier: "steer",
                             source: "steer",
                             delivery: "queued",
                             sessionSeq: nextHumanInputSeq(h.harness),
+                            ...(typeof inputId === "string" ? { inputId } : {}),
                             ...(actor !== undefined ? { actor } : {}),
                             ...(actor?.issuer !== undefined ? { issuer: actor.issuer } : {}),
                             ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
@@ -1645,9 +1673,21 @@ export class Runner {
                     const h = handle ?? (await orTimeout(ready));
                     if (!h)
                         throw steeringError("the task is not running");
+                    if (typeof inputId === "string") {
+                        const prior = acceptedSteerInputs.get(inputId);
+                        if (prior !== undefined) {
+                            if (resultValue !== undefined || h.loop.ended)
+                                throw steeringError("the task is no longer running");
+                            if (!sameAcceptedSteerInput(prior, replay)) {
+                                throw steeringError("a different steering instruction was already accepted under this inputId — re-issue this one with a fresh inputId " +
+                                    "(an identical payload would have been an idempotent retry)", "steering.duplicate_input_id");
+                            }
+                            return;
+                        }
+                    }
                     try {
                         await h.harness.steer(payload, { provenance: "engine-note", ...(actor !== undefined ? { actor } : {}) });
-                        emitAccepted(h);
+                        noteAccepted(h);
                         return;
                     }
                     catch (e) {
@@ -1658,7 +1698,7 @@ export class Runner {
                     while (resultValue === undefined && !h.loop.ended && Date.now() < birthDeadline) {
                         try {
                             await h.harness.steer(payload, { provenance: "engine-note", ...(actor !== undefined ? { actor } : {}) });
-                            emitAccepted(h);
+                            noteAccepted(h);
                             return;
                         }
                         catch (e2) {
@@ -2329,8 +2369,11 @@ export class Runner {
             queue.push({ type: "message_committed", entryId, role, ...(toolCallId !== undefined ? { toolCallId } : {}), ...ident() });
         };
         const subagentName = parentToolCallId !== undefined && internals?.agentName !== undefined ? inlineUntrusted(internals.agentName.slice(0, 320), 80) : undefined;
+        const statusSinkNotifier = createSafeNotifier({
+            onError: (f) => console.warn(`[sema-core] ${f.site}: run-internals status sink threw (contained; further failures counted, not re-disclosed): ${f.error.message}`),
+        });
         const statusEmit = (s) => {
-            queue.push({
+            const frame = {
                 type: "status",
                 phase: s.phase,
                 ...(s.detail !== undefined ? { detail: s.detail } : {}),
@@ -2340,7 +2383,12 @@ export class Runner {
                 ...(s.maxRetries !== undefined ? { maxRetries: s.maxRetries } : {}),
                 ...(s.errClass !== undefined ? { errClass: s.errClass } : {}),
                 ...ident(),
-            });
+            };
+            Object.freeze(frame);
+            const accepted = queue.push(frame);
+            if (accepted && internals?.onStatusEvent !== undefined) {
+                statusSinkNotifier.notify(() => observeThenableRejection(internals.onStatusEvent?.(frame), statusSinkNotifier, "runtask.onStatusEvent"), "runtask.onStatusEvent");
+            }
         };
         const telemetryEmit = (t) => {
             emitTrace(rs.telemetry.tracer, () => t.kind === "failover"
@@ -3656,6 +3704,15 @@ export class Runner {
                 throw new CheckpointError("checkpoint.invalid_outcome", `resume carries decision "allow" with settledBy "${settledBy}" — a non-human settlement is a fail-closed end (nobody answered), so it cannot be the source of an approval that EXECUTES; ` +
                     "supply \"human\", or omit the field if the allow came from configuration rather than a person; refusing pre-CAS, the checkpoint stays pending", { field: "settledBy" });
             }
+            const approver = decide.approver;
+            const attribution = screenApproverAttribution(approver);
+            if (attribution.defect !== undefined) {
+                throw new CheckpointError("checkpoint.invalid_outcome", `resume carries an approver attribution this engine refuses: ${attribution.defect}; refusing pre-CAS, the checkpoint stays pending`, { field: "approver" });
+            }
+            if (attribution.approver !== undefined && settledBy === undefined) {
+                throw new CheckpointError("checkpoint.invalid_outcome", `resume names an approver but no settledBy — an attribution says WHOSE settlement it was and needs the word that says what KIND of end it was beside it; ` +
+                    `supply settledBy ("human" / "timeout" / "aborted"), or omit the approver; refusing pre-CAS, the checkpoint stays pending`, { field: "approver" });
+            }
             const reason = decide.reason;
             assertOutcomeText(reason, "reason");
             plainPolicyOutcome = {
@@ -3667,6 +3724,7 @@ export class Runner {
                 ...(reason !== undefined ? { reason } : {}),
                 ...(redeemedAnswer !== undefined ? { answer: redeemedAnswer } : {}),
                 ...(settledBy !== undefined ? { settledBy } : {}),
+                ...(attribution.approver !== undefined ? { approver: attribution.approver } : {}),
             };
             if (plainPolicyOutcome.decision === "deny" && plainPolicyOutcome.reason && sanitizeUntrustedText(plainPolicyOutcome.reason) !== plainPolicyOutcome.reason) {
                 throw new CheckpointError("checkpoint.invalid_outcome", "resume deny/reject reason must not contain a </system-reminder> tag");
@@ -4029,7 +4087,7 @@ export class Runner {
         const resolvedArgs = pendingAction.toolName === ASK_USER_QUESTION_TOOL_NAME ? pendingAction.args : (outcome.updatedInput !== undefined ? outcome.updatedInput : pendingAction.args);
         const pendingLabel = (() => { const l = prepared.tools.find((t) => t.name === pendingAction.toolName)?.label; return l !== undefined && l !== pendingAction.toolName ? { label: l } : {}; })();
         emit({ type: "tool_start", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, args: resolvedArgs });
-        const emitEnd = (isError, result) => emit({ type: "tool_end", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, isError, ...toolEndBodyFrom(result, isError, outcome.settledBy) });
+        const emitEnd = (isError, result) => emit({ type: "tool_end", toolCallId: pendingAction.toolCallId, toolName: pendingAction.toolName, ...pendingLabel, isError, ...toolEndBodyFrom(result, isError, outcome.settledBy, outcome.approver) });
         if (outcome.decision === "deny") {
             const defaultDenial = outcome.settledBy === "timeout"
                 ? `No one answered the approval request for the pending tool call "${pendingAction.toolName}" — the approval window elapsed with no answer, so it was not executed.`

package/dist/core/safe-notify.d.ts

@@ -79,3 +79,12 @@ export interface SafeNotifier {
  * notifier whose callbacks never throw costs one object and nothing per call beyond the `try`.
  */
 export declare function createSafeNotifier(opts?: SafeNotifierOptions): SafeNotifier;
+/**
+ * Observe a `=> void` host callback's RETURN value for the async dialect: TypeScript accepts an
+ * `async` function at a void seat, and a rejected one would escape {@link SafeNotifier.notify}
+ * (which deliberately ignores return values — see the scope note above) as an unhandled rejection.
+ * Call this with the callback's return value INSIDE the notify thunk: a thenable's rejection is
+ * routed back through the same notifier/site, so async and sync failures share one count and one
+ * bounded disclosure, and neither can fault the engine's control flow.
+ */
+export declare function observeThenableRejection(r: unknown, notifier: SafeNotifier, site: string): void;

package/dist/core/safe-notify.js

@@ -57,3 +57,12 @@ export function createSafeNotifier(opts) {
         },
     };
 }
+export function observeThenableRejection(r, notifier, site) {
+    if (typeof r?.then === "function") {
+        r.then(undefined, (err) => {
+            notifier.notify(() => {
+                throw err instanceof Error ? err : new Error(String(err));
+            }, site);
+        });
+    }
+}

package/dist/core/tool-errors.d.ts

@@ -117,8 +117,8 @@ export type WorkerErrorClass = "budget" | "limit" | "output" | "suspend" | "revi
  * are NOT all terminal-errorCode-shaped — see {@link EXACT_CODE_CLASS}'s comment), plus the flat 1.36 codes.
  * The `limits.` namespace splits into the `budget` and `limit` classes by exact code — see
  * {@link EXACT_CODE_CLASS}. Operation-level dotted codes that are surfaced to a *caller* and never become a
- * task outcome are deliberately OUT of scope: `steering.*` (`steering.not_running`/`steering.invalid_content`,
- * rejected to the `steer()` caller) and `mcp.*` (`mcp.server_unavailable`, an `onWarn` warning code) — neither
+ * task outcome are deliberately OUT of scope: `steering.*` (`steering.not_running`/`steering.invalid_content`/
+ * `steering.duplicate_input_id`, rejected to the `steer()` caller) and `mcp.*` (`mcp.server_unavailable`, an `onWarn` warning code) — neither
  * reaches `TaskResult.errorCode`, so a caller will never pass them here. A genuinely unmapped code → `"unknown"` (which therefore means
  * "known-but-foreign or no code", e.g. a leaked fs/Node code, NOT "an OUR terminal class we forgot to add").
  */