@sema-agent/core 5.45.0 → 5.46.0

package/dist/core/runner/prepare-task.js

@@ -26,6 +26,7 @@ import { findAdmittingRule, suggestRulesForCommand } from "../permission-rule-mo
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
 import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentListingDelta } from "./turn-attachments.js";
 import { inlineUntrusted } from "../untrusted-text.js";
+import { isValidReminderMark, mintReminderMark, reminderMarkDeclaration } from "../reminder-mint.js";
 import { policyAskClassOf } from "../ask-class.js";
 import { emitTrace } from "../trace.js";
 import { createSessionRulePolicy, PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
@@ -333,7 +334,7 @@ function cwdConflictsRestoreError(requestedCwd) {
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
-    const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
+    const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, memoryProvenance, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
     announceToolModelGate(deps.onNotice, model.id, doors.modelGate);
     const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, ownToolNames } = prepareSafetyScan({ spec, deps });
     let shellGatedBash = false;
@@ -351,6 +352,30 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const taskScope = internals?.registryScope ?? spec.principal ?? "default";
     internals?.peerSelfRef?.addAxis("s", sessionId);
     internals?.peerSelfRef?.addAxis("t", hostTaskId);
+    const sessionReminderMark = await (async () => {
+        try {
+            return await session.getReminderMark();
+        }
+        catch (err) {
+            deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
+            return undefined;
+        }
+    })();
+    const reminderMark = isValidReminderMark(resume?.seed.reminderMark)
+        ? resume.seed.reminderMark
+        : isValidReminderMark(internals?.reminderMark)
+            ? internals.reminderMark
+            : isValidReminderMark(sessionReminderMark)
+                ? sessionReminderMark
+                : mintReminderMark();
+    if (reminderMark !== sessionReminderMark) {
+        try {
+            await session.appendReminderMark(reminderMark);
+        }
+        catch (err) {
+            deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
+        }
+    }
     const offloadScope = spec.principal ?? "default";
     if (internals?.registryScope !== undefined && internals.registryScope !== offloadScope) {
         deps.onError?.(new Error(`offload/tool-result namespace note: this run mounts in registry domain "${internals.registryScope}" but its offloaded tool results live under the TRUST identity "${offloadScope}" (principal${spec.principal === undefined ? " absent → default" : ""}). Before 2.13.0 the registry domain named this namespace too; if a deployment used registryScope as its ref-tenancy boundary, that boundary is now the principal — pass one, or read refs under "${offloadScope}".`), { phase: "config", sessionId });
@@ -797,6 +822,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...(spec.memoryPersistenceCapable !== undefined ? { memoryPersistenceCapable: spec.memoryPersistenceCapable } : {}),
             getApiKeyAndHeaders: spec.getApiKeyAndHeaders,
             parentCwd: taskRootFinal,
+            reminderMark,
             ...(centerAdoption !== undefined ? { centerArtifactDigest: centerAdoption.artifact.artifactDigest } : {}),
             ...(centerAdoption?.sourceRevision !== undefined ? { centerSourceRevision: centerAdoption.sourceRevision } : {}),
             activeSkillScope: () => skillScope.active(),
@@ -983,6 +1009,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 sourceTaskId: hostTaskId,
                 parentModel: () => harnessRef.current?.getModel(),
                 ...(spec.getApiKeyAndHeaders !== undefined ? { parentGetApiKeyAndHeaders: spec.getApiKeyAndHeaders } : {}),
+                ...(frozenOnAsk !== undefined ? { parentOnAsk: frozenOnAsk } : {}),
                 principal: spec.principal,
                 oneShot: spec.oneShot,
                 ...(resolvedInteractionPosture !== undefined ? { parentInteractionPosture: resolvedInteractionPosture } : {}),
@@ -1198,7 +1225,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         foldProtocolAxes(a2a.toolAxes, "A2A");
         const callIssuedAtRef = {};
         const memoryWriteGateRef = {};
-        const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, firstPartyOffload, tools, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes };
+        const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, firstPartyOffload, tools, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark };
         const handsReadFace = handsEnabled ? await prepareHandsMount(handsReadFaceInput) : resolveHandsLessReadFace(handsReadFaceInput);
         const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, additionalRootsCanonical, additionalReadRootsCanonical, attachmentRootCanonical, readDenyMatcher } = handsReadFace;
         resolvedReadFace = handsReadFace.resolvedReadFace;
@@ -1439,9 +1466,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             sessionId,
             taskRootPath: taskRootFinal,
             memoryWriteGateRef,
+            reminderMark,
             writeToolsMounted: tools.some((t) => t.name === "Write") &&
                 !(toolFaceSnapshot.exclude?.includes("Write") ?? false) &&
                 !(handsEnabled && isRemoteExecutionEnv(executionEnv) && spec.memoryPersistenceCapable !== true),
+            memoryProvenance,
             memoryPersistenceDeclared: spec.memoryPersistenceCapable,
             rosterCanPersist: spec.memoryPersistenceCapable ??
                 tools.some((t) => {
@@ -1644,6 +1673,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             policyEnabled: promptPolicyEnabled,
             hooksEnabled: promptHooksEnabled,
             isolationEnabled: isIsolated(executionEnv),
+            reminderMark,
             readFaceOpen: resolvedReadFace === "open",
             orchestrationEnabled: selfOrchestrationActive,
             orchestrationDeferred: selfOrchestrationActive && (toolFaceSnapshot.defer?.includes("Workflow") ?? false),
@@ -1904,9 +1934,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         continue;
                     }
                     const inner = t.execute.bind(t);
-                    const mark = (reason) => {
+                    const mark = (reason, cause) => {
                         try {
-                            pollution?.markPolluted(reason);
+                            pollution?.markPolluted(reason, cause);
                         }
                         catch {
                         }
@@ -1915,7 +1945,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         ...t,
                         execute: async (toolCallId, params, signal, onUpdate) => {
                             if (pollutes) {
-                                mark(`tool "${t.name}" (${origin} content class) was invoked in this session`);
+                                mark(`tool "${t.name}" (${origin} content class) was invoked in this session`, "observed");
                                 recordExternal();
                             }
                             if (!isDelegation)
@@ -1931,7 +1961,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             const att = readCardAttestation(result?.details);
                             if (att === "external") {
                                 mark(`tool "${t.name}" returned the output of a delegated agent that invoked an external-content-class tool at runtime` +
-                                    (typeof requested === "string" ? ` (subagent_type "${requested}")` : ""));
+                                    (typeof requested === "string" ? ` (subagent_type "${requested}")` : ""), "observed");
                                 recordExternal();
                             }
                             else if (att !== "clean") {
@@ -1939,7 +1969,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                     const staticFaceReason = `tool "${t.name}" returned the output of a delegated agent whose tool face can reach external content` +
                                         (typeof requested === "string" ? ` (subagent_type "${requested}")` : " (no subagent_type named — classified fail-closed)");
                                     if (!delegationEvidenceAttestedOnly) {
-                                        mark(staticFaceReason);
+                                        mark(staticFaceReason, "static");
                                     }
                                     else if (pollution !== undefined && !staticMarkWaiverAnnounced) {
                                         staticMarkWaiverAnnounced = true;
@@ -2043,6 +2073,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 centerAdoption = undefined;
         }
         let systemPrompt = assembled.systemPrompt;
+        if (!systemPrompt.includes(reminderMarkDeclaration(reminderMark))) {
+            deps.onError?.(new Error("reminder-mark declaration missing from the assembled system prompt: this run's PromptProvider owns the prompt and did not render the mark declaration, so engine <system-reminder> tags carry a mark the model is never told about (the impersonation defense is inactive for this deployment). Render `reminderMarkDeclaration(ctx.reminderMark)` (exported; the value rides StablePromptContext.reminderMark) in the provider, or accept the disclosure."), { phase: "config", sessionId });
+        }
         const renderWithDate = assembled.renderWithDate
             ? (date) => {
                 systemPrompt = assembled.renderWithDate(date);
@@ -3406,6 +3439,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 consolidationNotes: undefined,
                 readFileState: readFileStateForCheckpoint ? [...readFileStateForCheckpoint.entries()] : undefined,
                 readFace: faceCheckpointSection(),
+                reminderMark,
                 repairBundle: repairBundleForCheckpoint(parkedSpendMicroUsd),
                 workspaceHandle,
                 handsCwd: handsCwdRef?.current,
@@ -4069,7 +4103,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             if (notifyPermissionDenied) {
                                 await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: complianceDeny, source: "safety", identity: hookIdentity });
                             }
-                            return { block: true, reason: formatHookFeedback(complianceDeny), preToolContext: [] };
+                            return { block: true, reason: formatHookFeedback(complianceDeny, reminderMark), preToolContext: [] };
                         }
                     }
                     if (planModeRef.active && (toolEffects.get(e.toolName) ?? "write") !== "read") {
@@ -4082,7 +4116,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         return {
                             block: true,
-                            reason: formatHookFeedback(planDenyReason),
+                            reason: formatHookFeedback(planDenyReason, reminderMark),
                             preToolContext: [],
                         };
                     }
@@ -4092,6 +4126,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: spec.taskId ?? sessionId, site: f.site, message: f.error.message, ts: Date.now() })),
                             event: e,
                             identity: hookIdentity,
+                            reminderMark,
                             preToolUse: ownGatePreToolUse,
                             ...(hookEnvFace !== undefined ? { hookEnv: hookEnvFace } : {}),
                             adjudicate,
@@ -4208,7 +4243,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             details: clonedDetails,
                         }, { toolCallId: e.toolCallId, toolName: e.toolName, ...(hookEnvFace !== undefined ? { env: hookEnvFace } : {}), identity: hookIdentity });
                         if (patch?.additionalContext) {
-                            content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext) }];
+                            content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext, reminderMark) }];
                             changed = true;
                         }
                     }
@@ -4220,14 +4255,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         changed = true;
                     }
                     if (patch?.additionalContext) {
-                        content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext) }];
+                        content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext, reminderMark) }];
                         changed = true;
                     }
                 }
                 const pre = preToolContexts.get(e.toolCallId);
                 if (pre) {
                     preToolContexts.delete(e.toolCallId);
-                    content = [...content, ...pre.map((t) => ({ type: "text", text: formatHookFeedback(t) }))];
+                    content = [...content, ...pre.map((t) => ({ type: "text", text: formatHookFeedback(t, reminderMark) }))];
                     changed = true;
                 }
                 return changed ? { content } : undefined;
@@ -4501,7 +4536,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectiveReadFaceObserved = carrierReadFace();
         const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;